Decoder with Nilay Patel
00:00:00 · S0, S1
Ad[00:00:00] S0: Support for the show comes from Engine. Running a small business means every dollar has to work hard. But if your team is still booking travel the old way, it's costing you more than you think. Engine is the fastest growing travel and spend platform in the country built specifically for businesses like yours. Ad[00:00:17] S1: Book a trip in as little as two and a Ad[00:00:19] S0: half minutes. Earn up to 10% back on hotels. And in 2025, Engine customers save more than $300,000,000 on travel with zero booking fees, no contracts, and no BS. More than a thousand businesses join Engine every month. Join them and get $500 when your business signs up and starts traveling at engine.com/vox.
00:00:47 · Nilay Patel
[00:00:47] S2: Hello, and welcome to Decoder. I'm Nilay Patel, editor in chief of The Verge, and Decoder is my show about big ideas and other problems. Today, I'm talking with Alex Stamos, chief security officer at Cognition and a longtime cybersecurity expert about what a mess security on the Internet is right now. This episode is part one of the special series looking at AI in real life. I've always enjoyed talking to Alex because he's so direct. And you're gonna hear him say that the multi billion dollar cybersecurity industry as we've known it is essentially over due to the unrelenting AI boosted waves of hacks, breaches, and attacks. And all of those are only the beginning. Both script kiddie hackers and also nation states like Russia and North Korea are breaking into systems all over. Thanks to AI helping them both detect and exploit vulnerabilities all at the same time. It's got a real frontier feel to it. You're gonna hear Alex say it feels like the nineties all over again when the whole idea of an always online world was brand new. That much disruption means there are a lot of places where bad guys can get in while everyone else is left scrambling. Alex isn't a doomer in the long run, but he does think we're in for a quote dark age while we try to figure out how to adapt this new era. There's a lot going on in this conversation. We even got all the way to how AI powered misinformation and slop might be managed on our social networks. Before we get going, do me a favor and subscribe to Decoder on YouTube where we put out new episodes every Monday and Thursday. Okay. Alex Stamos on how AI is upending cybersecurity. Here we go. Alex Stamos, you're the chief security officer at Cognition. You're also a lecturer at Stanford University Cyber Policy Center. Welcome back to Decoder.
00:02:08 · S3, Nilay Patel
[00:02:08] S3: Hey. Thanks for having me, man. [00:02:09] S2: I'm excited to talk to you. It's been a long time since you and I chatted in the... What you might call the content moderation era of Internet policy discourse. I feel like you and I talked a lot about how all that was working, about election security, all those sorts of things. We're in a new era of big problems on the Internet, particularly around cyber defense, cybersecurity. You've been thinking about this stuff a lot. You referred to the past few weeks as security awareness month. Tell me what's tell me what's going on. Just give me the give me the way you land right now.
00:02:37 · S3
[00:02:37] S3: October is, you know, traditionally security awareness month. Right? Like, lots of companies run events and and deal both internally and then tell people, you know, change your password. Use multiple passwords. Use a password manager. And and what has happened over the last month is we've had, you know, a couple of these big bugs, PHP, Node, and such. What's been less discussed is a huge number of companies have been reached. You have a series of AI related companies, the Neo Clouds, that have been breached in succession. You have the Binance hack, which is the largest heist of anything in human history. You have the cursor incident where, you know, one of the things that's going on here is these hacks are being chained together. So it looks like from what we know right now, one of the companies that was broken into was Fireworks, which is a prominent provider of AI services to a number of companies. From the Fireworks hack, API keys were stolen that allowed people to break into Cursor. Once they got into Cursor, they then pushed a bad plug in, which went to 5,000 more companies, and that caused 5,000 potential breaches. So it's just this kind of permanent continuous breach that is going on throughout the tech industry. And one of my friends said, a CISO friend of mine said to a bunch of us, is anybody else tired? And and everybody said yes. Because, effectively, we have been at DEFCON two for all of October and now going into November.
00:04:14 · Nilay Patel
[00:04:14] S2: So I'm gonna ask you some some really dumb questions here. Who is behind all these attacks? Is it Russia? Is it North Korea? Do we do we know?
00:04:23 · S3
[00:04:23] S3: It's a variety of different groups. It is it is not just because adversaries have decided, but what has happened is, from my perspective, we are at the start of the takeoff of adversary capability enabled by AI, that the open weight models have now gotten to the point at which you can automate most of the kill chain. You know? So this kill chain term is something we stole from the military. Right? In the military, they mean to actually kill something. You... There are the steps you do to blow something up. In cyber, the kill chain is the things you do to have an effect on a target. So to steal information, to turn something off, right, to steal money, to steal Bitcoin. Yeah. Traditionally, you, you know, do research upfront. You look at a piece of software. You find a vulnerability. You write exploits, and you do that all way ahead of time. And then you have a human being go and take that stuff you built and deploy it against either one target because maybe you're a government and you're going against Lockheed Martin or you're going against another government. Or you're a ransomware actor, and you take all that work you did and you deploy it against hundreds or thousands of targets really fast. Well, now with AI, what's happening is this kill chain has inverted where you can run an AI system that just goes hog wild, and it looks at the targets, and it finds the bugs in real time, and it writes the exploits in real time, and it breaks into these companies. So that's one of the things that's happening is it... These systems are going, and they're so good at finding bugs that they are finding the bugs in real time and writing the exploits in real time. And so the system that everybody's talking about is not the only one. The system we're used to talk about is a thing called RTX, which is a Chinese open source tool that anybody can go look at. There's a English translation on GitHub that you can check out. And if you power it on the back end by something like an obliterated GLM five three, it will let you break into a shocking number of organizations. This started with three South Korean banks. This week, about 200 more companies have been hit. I've been helping a couple of companies. Cognition has been kind of... You know, we're not incident response company, but we do go in and, like, help people fix their bugs afterwards by using our tools.