AI broke the cybersecurity world. Now what?

00:56:29 · Nilay Patel, S3Play from here

[00:56:29] S2: Man, I could do another whole hour with you on this because the the the system you're describing there is not detecting AI content. It is verifying real content. [00:56:38] S3: It's much easier. Verifying real content is much easier. Right? And and there's been a big focus on this on the professional side. Right? Like, Adobe has a whole thing of, like, if you're a New York Times photographer, you have a $5,000 Nikon or Canon. You take the photo, [00:56:51] S2: and it's here has that in it now. [00:56:54] S3: Right? Like, there's a lot of this now. Yeah. [00:56:56] S2: There's a there's a lot of this out there. It's... But it's the other side that I'm I'm thinking about. Right? Where it's... We are going to detect AI text. Right? The the the leading model companies, because of European regulations, are now, like, futzing with the text they generate so they [00:57:10] S3: Text is much text is much harder because you just have so much less data. Right? Like, especially if a 140 characters, like, what do you have in there to detect? You know, the more you've got, the more you can do. [00:57:19] S2: It is amazing because I can detect Claude a mile away. So may... Maybe maybe I'll just rely on my own [00:57:24] S3: human judgment. Not in a... Not in tweet length. [00:57:26] S2: That's true. The the cheap ones, can. But I'm just saying, like, the notion that we're gonna verify what's real instead of detecting what's fake feels very important in the context of the media we consume.

00:57:26 · Nilay Patel, S3Play from here

[00:57:26] S2: That's true. The the cheap ones, can. But I'm just saying, like, the notion that we're gonna verify what's real instead of detecting what's fake feels very important in the context of the media we consume. [00:57:40] S3: I think detecting what's fake is always gonna be probabilistic, and we're gonna asymptotically approach impossibility, whereas detecting what's real can be cryptographically perfect. So I I would not pick the battle that we will eventually lose. I would pick the battle that we can cryptographically win. That would be my suggestion. [00:57:58] S2: And there's somewhere in there where you have to build an entire chain of custody. Right? We're gonna take the sensor data off the camera. We're gonna put it in a cloud server. We're only gonna allow edits on this server. That file will never get monkeyed with. [00:58:10] S3: Sure. That's true for the New York Times. [00:58:13] S2: Yeah. [00:58:13] S3: And you know, Adobe Photoshop and stuff, but not for Instagram. For Instagram, you can do it all because it's it's only the iPhone, and it's only Instagram. So, like, you... The entire chain of custody is within your app. It is within the iPhone sensor. It's in Instagram. So, like, it's actually easy for them. [00:58:29] S2: Look. Like I said, we could do another whole hour on that because it feels like right next to the cybersecurity problem is the social engineering problem, and right next to the social engineering problem is the fake media problem. Right? Like, how many phishing attacks are just this website looked pretty real? And

00:58:29 · Nilay Patel, S3Play from here

[00:58:29] S2: Look. Like I said, we could do another whole hour on that because it feels like right next to the cybersecurity problem is the social engineering problem, and right next to the social engineering problem is the fake media problem. Right? Like, how many phishing attacks are just this website looked pretty real? And [00:58:46] S3: Oh, yeah. [00:58:46] S2: Or this person is talking to you, or there's an AI voice on the other side of the phone. And all of that comes down to, can you detect what's fake instead of verifying what's real? And I Oh, no. [00:58:55] S3: I I've had to train my... Yeah. I've had to train my parents that if you get a video from your grandchildren saying they've been kidnapped, you have to call me because the odds that it's real is is not very high. [00:59:07] S2: Yeah. [00:59:07] S3: Right? Like, that's where we're at as a as a society. [00:59:10] S2: I feel like I wanna end on a hopeful note, and I don't know how to do it from there. [00:59:14] S3: Wrong guess for that, buddy. Yeah. [00:59:17] S2: This is why you only come out every few years. But now after this, we're gonna we're gonna do the series of, like, birthday party guests. So you... You've been talking about the dark ages. You you... We're in it, right, where it's starting to accelerate. What are the markers people should look for in terms of progress? Right? To say, okay, we're climbing our way back up.

00:59:36 · S3Play from here

[00:59:36] S3: AI is great for lots of things. I think AI is going to enable individuals. Right? Like, we're gonna see a huge explosion of new companies. Like, you could start... I mean, Stanford students have always been entrepreneurial, but the number of my students who are now starting two, three, four person companies who are doing incredible things, who used to need to hire 50 or a 100 people and take a ton of venture capital is incredible. Right? So I think we're gonna continue to see that. One of the things we hopefully see is we start to see a a... We'll see a downtick in the number of major breaches at some point. We should hopefully see a downtick in the major CVEs that are wormable and that are in kind of the fundamental infrastructure pieces kernel. You know? Like I said, I want Linux to be rewritten, but hopefully, we see a downtick in, like, the Linux kernel and those other kinds of libraries, you know, OpenSSL, glibc, things like that. I haven't seen... Maybe I should vibe code this up, but I think it would be cool to have, like, an index of, like, where are we in this cycle Mhmm. Of of, like, an artificial index of all of these... You know, the DAO for all of the libraries of of of where we're going. Plus, you know, right now, patch Tuesday used to be, like, a 150, 200, got to 300, 600. I think the last one was 900 something, so we're geometrically growing. So it'd be nice to see Patch Tuesday start to go back down. Yeah. Apple patches are the same thing. Yep. You you inspired me. So I'm gonna I'm gonna create a Dow index for this of of the the the dark age index. Right? And then maybe we can publish it on The Verge.

01:01:13 · Nilay Patel, S3Play from here

[01:01:13] S2: Yeah. [01:01:13] S3: But I think these are the kinds of things that it would be nice to see a reversal, and what it would be especially nice to see is that the day... Or actually, like, thirty days before you get, like, the next version of OpenAI and Anthropic cyber models that you don't have this huge round of patches. Because what's happening is those guys are running their models against Microsoft's code, against a bunch of open source, and they're giving all the the bugs away, and you don't know where the bugs are coming from. Right? It's just like anonymous reports for a thousand bugs in the Linux kernel. And and then a month later, here's the new AsterCyber. And so if those get smaller and smaller every time, then it means that we're starting to reach some kind of steady state. [01:01:53] S2: You should definitely do that tracker. We will definitely publish it. Alex, it has been incredible to have you on the show. We'll have to talk again soon. [01:01:58] S3: Yeah. Thank you so much for... I think you do some of the best journalism on this stuff, and I really appreciate it.

01:01:58 · S3, Nilay Patel, S0, S1Play from here

[01:01:58] S3: Yeah. Thank you so much for... I think you do some of the best journalism on this stuff, and I really appreciate it. [01:02:04] S2: I'd like to thank Alex for joining me, thank you for checking out this episode of Decoder. I hope you enjoyed it. To get new episodes every Monday and Thursday, subscribe to our YouTube channel at Decoder Pod. Find us on TikTok and Instagram under Decoder Pod as well for more fun stuff we put out every If you like to let us know what you thought about this episode or really anything else at all, let us know. You can drop us an email at decoder@theverge.com. We really do read all the emails, or you can hang up directly on threads or blue sky. If you enjoy this episode, please send a link to it to someone you think you might like it as well. It really helps us grow the show, which you can subscribe to wherever you get your podcasts. Decoder is a production verge and part of the Vox Media Podcast Network. Show is produced by Greg Ott, Kate Cox, Nick Statt. Our editors are Xander Adams and Ursa Wright. Our editorial director is Kevin McShane. The Decoder music is by Breakmaster Cylinder. We'll see you next time. [01:02:46] S0: Support for the show comes from Engine. Running a small business means every dollar has to work hard. But if your team is still booking travel the old way, it's costing you more than you think. Engine is the fastest growing travel and spend platform in the country built specifically for businesses like yours. Book a [01:03:04] S1: trip in as little as two and