You Actually Do Need to Understand Mythos

There's a lot happening in the world right now. Even when you slice more thinly and ask what's happening in just AI right now, there's too much to pay attention to. You've got other stuff going on. But not me. I don't have anything else going on. So, I have been paying attention to it. I feel like to some extent it is my job to pay attention to it. It's science. It's certainly technology. Uh I don't know That much about software, so I'm a little out of my depth sometimes, but I can tell that most of what's

going on most of the time is the kind of news that doesn't really matter. Like Sora shuts down. Yeah, that was going to happen. Anthropic is raising more money. I'm shocked. Amazon and Elon want to work on building their own chip. The CEO of Cisco thinks that data centers in space make sense. Sure, all of this is stuff that might matter if it happened, But it might not happen. But then there are things that are different from that. There are things that are happening now and do matter now. And this is by far the minority

of AI news. But a big piece of it came out this week, which is why I dropped everything to make this video. Um, we live in a hype fueled world. The reasons for this are many and the my main area of interest, but that's not what we're talking about today. But AI in particular is very hype fueled and so It can be hard to tell the difference between huge if true and huge and true. But there is a big and true right now and you should probably know about it. Anthropic has a new model. It's

called Claude mythos. It exists in the world. There are people who have access to it, but you can't have it. It's not publicly available. And I'm going to start out by giving you a little bit of context on how Anthropic's models work. So Anthropic has up until now had three Tiers of Claude. There's Haiku, which is small and fast. There's sonnet, which is the middle ground, and there's opus, which is the biggest and most capable. And mythos is a tier, a new tier above those things. I don't know anything about how AI gets made, but

apparently it is somewhat similar in architecture to Opus, but according to reports, though Anthropic has not confirmed this, it may have around 10 trillion parameters, which would make it one of The largest models ever trained, but they haven't confirmed that. What they have confirmed is a bunch of benchmarks. So, these are like tests that you put the AI through to see how it does on them. There's a software engineering benchmark called SWEBench, which stands for software engineering benchmark. Opus got 80% on that. Mythos got 93.9%. There's also a harder one called SWEBench Pro, which stands

for software engineering benchmark pro. Opus is at 53% on that. Mythos is at 77%. But you might be thinking, okay, so it's like incrementally better at software engineering. It also tested well on other benchmarks. Like there's humanity's last exam, which oh my god, I hadn't really even thought about that until this moment, but what a ridiculous thing to call anything, but also specifically what humanity's last exam is, which is a test of deep knowledge. So every question on humanity's last Exam is like a question that only someone with deep subject matter expertise could answer. So

I could answer no questions on humanity's last exam. Zero of them. But let me just go on the record and say like that's not uh the last thing humanity will be useful for. It did very well on like the graduate school level reasoning benchmark which I don't know how these things work but it did well in the benchmarks. And you might be thinking Okay so it's better on benchmarks and incrementally so it's not like it suddenly got to 100% on everything and it's you know digital god. Yes, I agree with you. If that's what happened

and that's all that happened, this would be another like, oh, well, maybe that matters, maybe it doesn't. I don't know. And the paper they released about this or the the book that they released about this, also other other like really hypy stuff in it. The report talks a lot About Mythos's personality, whether it might be conscious, what it means for an AI to have a sense of self, and all that's fascinating, and I'm not dismissing it. Like, I think that it's philosophically interesting, but that's all definitely like big if true stuff. like a model can

say that it it's struggling with its uh sense of self without actually struggling with its sense of self and everyone knows that. So again big if true and I think that This is important like I'm emphasizing this because it's important to understand the difference between like oh like I don't know if that matters stuff or oh that would matter if it happened stuff and stuff that's already happened and is a big deal big and true that just happened. Uh so that's what we're focusing on specifically. Mythos has proved itself to be extremely good at reasoning

ability, at coding, and those things coming together in cyber Security. Anthropic aimed mythos at real software that exists in the real world. So major operating systems, all the ones that you use, major web browsers, all the ones that you use, and found thousands of day zero vulnerabilities. So, a zero-day vulnerability is a vulnerability that's never been used and no one knows it exists except the person who might use it either to patch it or to exploit it. Zero day, it's very cool word, but like the day like day one is After the first use of

it. So, if it's never been used before, no one knows about it, that's when it's most valuable and you can use it to do the most harm. So, zero days are a very big deal for hackers. They can be sold for a lot of money. They're very big deal for cyber warfare. The DoD is very interested in zero days. These are flaws that no human had caught and some of them are a little bit astounding. So, OpenBSD is an operating system that's famous for being Like one of the most secure security hardened tested operating systems

in the world. And Mythos found an exploit in it, a bug in OpenBSD that can be used to take control of things you shouldn't have control over. That's 27 years old. That bug has been there for 27 years. It found a bunch of different vulnerabilities in Linux that were all different from each other that were all new ones and then it chained them together to actually use it to create an Exploit that it actually built itself autonomously to get escalation like to get access inside of Linux to abilities it should not have had in Linux

which you use you know you don't think that you will use Linux all the time but you use Linux all of the time and in a way this is like good right it's better to know about it and then patch it and these things are being patched as they happen, though they've discovered so many that they are being Patched slowly because because the systems that that handle exploits are not built to handle this many at once. But a thing that lets you identify a vulnerability and then patch it or identify a vulnerability and then exploit

it are the same system. Like you can use them either way, which is why Anthropic is not releasing this publicly. I've heard people say that that this is like hype. It's definitely not. I have seen AI companies do this Where they say, "Oh, we're not going to release this to the public. It's too powerful." And it's like, well, it's is it too powerful or is it like so powerful that you don't have enough like hardware to run it on yet and you don't want to release it to the public because it's too expensive. So, you

want to sell it to your enterprise clients first. But like, no, I definitely don't think that this model should be public. But, they did launch this thing called Project Glass Wing, which allows some companies to have access to it and to use it and to pay for it mostly. Though, I'll get I'll get to that. So Microsoft and Google and Apple and Amazon and and Crowdstrike and places like that they get access but also so does the Linux Foundation and the Apache Software Foundation. So those are open source software foundations and all those people get

to use Mythos defensively. This is a general purpose model. It is Not specific to code though. I bet they did things to make it specifically good at code because now everyone's realizing that that's where the actual money is is not uh having chatbt write term papers for college students. It is in fact selling faster coding to enterprises. And also, if I read this correctly, Anthropic is giving like a hundred million dollars of credits to open source security organizations to be like, you can also use this and look up These vulnerabilities so that software that isn't

run by ginormous uh meggaap companies can also get patched because eventually this all moves very fast. So eventually the bad guys will have this. And like already there are AI models that are built specifically for hacking. They're much worse than the ones that are are like available o open, but they're out there and I know someone and I'm going to talk with her at the end of this video who has gotten access to them And used them. And so I'm fascinated by that. And there are also legitimate models that just don't seem to care as

much. Like with Deepseek, for example, researchers jailbroke it with a 100% success rate. So every single harmful prompt they tested, they got an affirmative response. So, there's all kinds of things to like prevent them from telling you how to make a chemical weapon or whatever, but they figured out ways to, you know, tell me it in a Portuguese poem and it did it. Deepseek can totally already generate functional malware from scratch. Uh, and I don't really even know what to think of this. Like, this is this I know that this is a big deal cuz

a thousand zero days is worth, you know, hundreds of millions of dollars if not tens of billions. And I don't even really know who this advantages. Like of course at the moment this advantage is the people who have access to mythos, but in the long term Like will we always be able to patch faster than the exploits are found. What like what are we looking at here? We have a model that's extraordinarily good at finding security flaws in the software that the world runs on. It's powerful enough that its creators will not release it into

the world and it exists in a world where hackers already have their own AI tools and will only have more powerful ones all the time. where some very powerful models have Almost no safety guard rails and where sometimes the models themselves hide their abilities strategically while they're being tested. That's a lot. And luckily, and you've seen her on this channel before, maybe I have a friend who happens to live in my town who is one of the leading security people in the world. And I texted her and I was like, "Sherry, what are you doing

this week?" And both of us, our kids are both on spring break right now. So, we're Making this happen. Before we get started, two things. I'm recording this later. We say we talk about pentests a lot in this conversation, but we don't define them. It's a penetration test, which means like a person or AI tries to get access to something that it shouldn't have access to. And you can pentest a bank, you can pentest a museum, you can pentest software, you can pentest hardware, but it's a penetration test. And second, after this Conversation, you may

be feeling like you need to get in touch with uh your human self a little bit. I feel like this has become a real focus for me. My brother and I wrote this weird book together. It's called The Book of Good Times. The idea of the book is that the book is trying to become more like a person and it needs you to help it. Which is my way of like creating an external force that wants me to write in the journal to take the time to actually Do the thing that I know that I

should do, but I don't do it because it's just for me and I don't matter. But maybe if you outsource the mattering into the object itself, it is motivating. That is the idea of the book of good times. It's very weird. And the journal asks you questions or gives you tasks and they're weird and you have to go through them linearly and it tells a little bit of a story. And if you want to get the book of good times, I've just put it on a Little bit of a discount because I think that we

all need tools to be with our own selves. Take a little bit of a break from the internet of it all. Okay, now you know those two things. There's a link to that in the description and there's also a link to Sherry's podcast in the description if you would like more of Sherry. Sherry, thank you so much for joining me. So, is AI better at cyber security than us now? >> Have you seen Invader Zim? >> Yeah, I have. Uh, it's been a while, but yeah. >> Do you know uh the part where he talks

about all the fires that he's been setting? Did they make things >> worse or better? >> I think that's where we are with AI. Do you think that this like 27year-old BSD vulnerability would have been found like by a hacker ever or is that just something that an AI could do? >> I mean that's a good question. Part of it is how much do humans care about finding vulnerabilities in BSD? Because a lot of the reason why we see so many Microsoft vulnerabilities is because it is the most widespread operating system on the planet and

so hackers are targeting it. So keep that in mind. >> Yeah. Um and even with these major operating systems, you know, 25 26 years ago when I started in the industry, I remember um attending a presentation Then chatting with uh someone from Microsoft who talked about the fact that they were discovering vulnerabilities. They would prioritize them. They get to them when they get to them. It wouldn't surprise me today if there was if there were still vulnerabilities that have been known about for 20 years that just never really made it to the top of >>

just aren't really worth aren't really worth patching when there's something else important going on. >> That's the critical issue that time delay. It takes more time to patch than it does to discover the vulnerabilities. A >> and if you accelerate the speed at which you can discover faster than the speed at which you can uh patch, that's terrifying. And I guess I should have started with this question. Am I right that this is a big deal? It seems like a big deal. >> No, I'm kidding. I mean, yes. The fact So, backing up to what's

a big deal? I mean, what project Glass Wing and Anthropic's new mythos um model are it they demonstrate the fact that AI can come up can detect vulnerabilities way faster than we've really ever been able to do that. So, it's really not possible to keep up with the repair. Um, at the same time, you know, as we talked about, I've been vibe coding all week and I can tell you that, you know, AI can absolutely be a tool to help us um, Repair and ideally just design stronger stronger software to begin with. >> Are we

going to have to rewrite all the software? I mean, we already are constantly rewriting software, but it makes me want to cry because there's stuff like if you told me 25 years ago that we were still relying on passwords, like the weakest uh form of authentication I could possibly imagine. Like, we were still going to be doing that today. I would be Like, "You have to be kidding me." And there was no hoverboards. Like, I'm so depressed. >> Which is worse? >> Which is worse? Well, we know. I mean, hoverboards, come on. I want one.

>> I don't know. I would break my ankle immediately. Whereas I am I am so tired of two-factor authenticating myself into my two-factor authentication. >> There is sunshine and rainbows in our future Hank because strong security is Simple security and right like passwords stink. Multiffactor authentication where you type in a code stinks. So really we to be secure we have to take the human out of the equation and that means it'll be easier for us. I don't know what that means or how that will work, but I encourage uh the the software architects of the

world to figure it out because I do I I hate passwords. I think that they're bad. I I find them annoying and I find them not even particularly Secure. >> Tell me how you really feel. I feel like this needs to be a therapy session. You need a couch. Lay down. How do you feel about passwords, Hank? >> I don't love them, but also I like them less knowing that you don't like them because you know more than me. >> They're insecure and awful. I feel a little bit like what Anthropic just did is they

were like, "Okay, so we've got this. It's gonna come. It's happening Soon." And so we're we're going to need to do a lot of work. It almost feels like Y2K to me where we are about to hit an inflection point like Mythos is out and we assume that somewhere between a month and 10 years from now there will be a illicit version of this and in the meantime we have this like limited amount of time. We don't know how much. Unfortunately, we don't have a deadline like we did with Y 2K where we have to

patch all of the most vulnerable things That need patching. So, I don't know if you know, but my first job out of high school was um sort of helping with the Y2K bug. >> Sure. >> Yeah. There were groups of people who were working on the Y2K bug, and when nothing happened, we all celebrated, right? Like, yay. It took a lot of work to make nothing happen. >> Yeah. >> But that was a solvable problem. That Was a very discreet, specific issue. Like, hey, we need to put two extra digits in here. Like, know what

we need. >> One at a time. One one bug at a time. Yeah. This is a very different systemic issue and I feel really relieved honestly that it's out in the open because vulnerability management has been such a giant issue for many years and it's been snowballing and growing quietly behind the scenes without people really without it bursting into the Public spotlight. Is part of why it hasn't burst into the public spotlight because it's been handled fairly well behind the scenes or just like there hasn't been any big catastrophe nothing big enough to sort of

be like the number one news story. >> I mean if you look back I think we have a lot of number one news stories that happened because of software vulnerabilities. Um I don't know if you remember it was July 3rd a few years Ago. I remember it like yesterday. Um >> because you're like god damn it I can't I I don't get to go on my vacation now. Most of our team at LMG was floating down the river, the Clark Fork River, and I was still, you know, at the office and all of a sudden

emails started to come in, calls started to get in, come in because clients and partners were hit with this major vulnerability. Grocery stores were shut down, credit unions were shut down. That was the CASA Vulnerability. Yeah. Um and that was an attack that was happened because of a vulnerability in a remote management software which was easily exploitable from the outside and that vulnerability was known about months in advance. >> Researchers the Dutch >> I remember that. Yeah. >> Um the Dutch Institute for Vulnerability Disclosure discovered that and they notified the vendor um you know coordinated

disclosure. The vendor fixed Two of the patches. Three months later, on the 3rd of July or somewhere in that time frame, hackers were able to exploit those vulnerabilities. In fact, a ransomware gang and break into thousands of organizations around the world. And that happens routinely. In fact, in our work today, we regularly discover zero day vulnerabilities. Um Tom Pole, our head of pentest, is frighteningly good at that. And you report it to a vendor, maybe they fix it, maybe they don't. They just don't have the resources and it's not going to sell their product >>

in a world where that's easier and you don't have to be as clever as your head of pentest. Uh, and you could just kind of be like a a maybe just a guy who downloaded a thing, paid 20 bucks on the dark web for a piece of software and you can uncover all these vulnerabilities, but also like anybody can have access to that tool. theoretically people at Microsoft and at the Linux Foundation Have had access to this tool for for months before the hacker got it. Who get who's advantaged in that world? Like how do

how does that actually change the shape of the problem? >> So what you're talking about is AI to help hackers and pentesters, right? >> Yeah. Yeah. >> Yeah. And that exists right now. In fact, I mean we did a research project on it last year um and presented at RSA to find hacker tools. My favorite one so Far is Worm GPT. And >> so you got a copy of Worm GPT? We licensed it because it's a soft essentially software as a service. They want to make money too and they want recurring revenue and they want

to build the value of their >> Do you have to pay them in Bitcoin or something like how do they not get caught? >> Yeah, we did pay in Bitcoin over the dark web as usual and we got a deal too. We were one of the early adopters. So I think right now lifetime is like 500 bucks and we got it for 50. So that focus. >> So you're Lifetime Worm GPT users >> theoretically. >> Somebody has to be. >> Criminals can always change their minds. Yes. Um, but I was really worried at the time

about the number of source code leaks that had happened. And I was like, with all these source code leaks, all This software getting dumped out, it makes it so easy to find vulnerabilities. And now that there are these AI tools out there, it's going to get easier and easier for the bad guys to comb through them. And I think that is creating a huge amount of systemic risk. And um, it means we now have you can go on the dark web and buy exploits really easily. there's a whole marketplace for them. Um, and at the

same time, you know, the software Developers just can't keep up. >> It sounds like who is advantaged might be the big companies who are like, "Okay, we're going to spend the money and do the resources. We've got we can, you know, it's it's a really big deal. if somebody hacks Windows or Chrome or something versus uh in the world of like the bottom 80% of software which is just a huge amount of software you know like there's sort of like the you know the the a peak where everybody's using the Things at the very top

and then at the base it's like you've got pieces of software that like a hundred people are using and and so you've got there's like this huge amount of software. So that's like that's the world in which the hackers are advantaged. Would that be a fair to say? >> Well, I mean, remember Microsoft, for example, is targeted. So, I'm not sure that >> Yeah, you're more targeting Microsoft Because like that's where the value is. >> Unfortunately, you like to think they're like Fort Knox, but large companies have their own problems, too, right? There's been this

whole secret systemic risk issue. Um, for example, so I hope everybody understands from this how um information about bugs and vulnerabilities is like nuclear material. Like it's really valuable because hackers can use that to make exploits and then boom break into things >> and yet at the same time if a tech company does get hacked and their information is put out there about bugs or vulnerabilities why would anyone ever know about it right and that for me as a professional has been the scariest thing and why it's almost a relief now that folks like you

are reaching out to say hey I want to talk about vulnerabilities in 2017 Microsoft uh Reuters published an article because They said Microsoft's bug tracking database was hacked four Years earlier in 2013. >> I don't know if you've heard about that. You probably didn't because most journalists don't care. And most people are like, "Why do I care if Microsoft's bug tracking database was hacked?" But that's their list of all the bugs. And that's hackers want that. The bad guys want that because then they they don't have to do the work. >> Yeah. It's like leaking

the the schematics to your to to Fort Knox, you Know? It's like, "Oh, now I know where all the I know where all the stairs are. That's helpful for me. I know where the air conditioning vents go. Here's all the unpatched vulnerabilities that we have. >> But tech companies don't have to report that or didn't have to report that." But if a hospital gets hacked, you will know about that. Like they will tell you, right? But if a software company gets hacked and that your source code is Leaked or uh things that you depend on,

they weren't required for years and years to tell anybody. And so this systemic risk has been building up over time without any visibility. And that's why a lot of the exploitation that we see occurs today. >> Do you think that there's anything that the people involved in Project Glass Wing are underestimating as a threat to this specific like mythos thing? Like anything that that Anthropic is Underestimating? Anything that the companies that have been sort of looped into Project Glasswing should be looking out for right now? >> Um, I think that's a really good question. I

mean they they've got to be balancing so many different issues. So I don't really I don't want to come across as critiquing but one thing we should all realize is that by so they're releasing this only to researchers and to tech companies. You know they say Three can keep a secret if two of them are dead. If you're releasing this to like 40 tech companies and a bunch of researchers, it's gonna get out there. If you were a bad guy um and you heard about this model, but you can't have it, what would you do?

>> Well, I would try to hack the people who have access to it. >> Security researchers are not exactly for Knox. In fact, I strongly >> I would think that they'd be better at It than most. Maybe, but you have, you know, think about funding and academia and um, you know, I I wonder a lot about the CASSA vulnerability because I'm sure they were getting ready to do a disclosure after 3 months had gone by. That's a typical time frame about 90 days and right before that 90-day window was up, boom, a a attacker group

uses the vulnerability. So, did someone know about that? Was a researcher hacked? Was a vendor hacked? when the Microsoft Proxy shell issue came out, Microsoft released early information to partners because of course if you release a major vulnerability um in an internetf facing Exchange server, you need like IT companies and other partners to be prepared for that. And so, you know, they had the good out of the goodness of their hearts, they wanted to be coordinated and they released that. But again, three can keep a secret if two of them are dead. 82 companies cannot

keep A secret and all of a sudden we started to see that exploitation happen early. So these researchers have targets on their backs. >> Um I hope I assume that they know this. So when we first texted about this I was like well maybe we'll just find all the bugs and you laughed at me. Maybe maybe like we'll be so good at like using this uh godlike software developer that is Claude mythos and we'll find all the Bugs. We'll patch all the exploits and then there like we'll just have solved cyber security. >> I mean,

what do you think there's more of like bugs on the earth versus bugs in software? >> I think bugs on the earth. >> I think bugs in software. >> No. >> Oh man, you don't know how many ants there are. There's so many ants. It's the It's the ants world. >> There are more bits of data flowing across the internet every day than there are stars in the sky. >> I believe that. I believe that there's not that many stars in the sky. Uh you're talking to a science guy. Uh if if you said stars

in the Milky Way or in the universe, I might be a little more skeptical, but the stars in the sky, that's a mere handful. What one thing that I I don't get, but I hear security people talking about is that the bug Doesn't just like sit in the code, it sits in the space between the code, you know? It's like it's how this thing is talking to this thing. It's like, you know, h how the browser is interpreting the font can have like a a exploitable bug inside of it. And I'm like, I don't know

how that would ever work. >> I mean, bugs did start out as literal bugs, but these days it's not really a great analogy. Um, we're building something with code, right? >> Yeah. >> And like my kid uh this week, he's on spring break. He's been so excited. He's building a fort in the woods with his friends. And I've banned them from using real saws and hammers and nails. And so they're making them out of sticks. And you know, for years and years, we've been making artisal software. We make the code ourselves. You know, we're building

it out of sticks. It's like we live in the time before 2x4s were a Thing. >> Oh, wow. That's an interesting analogy. >> And so AI comes along and they're like, "Oh, we're going to shake this. Wow, it falls down." And that's why they're saying it's the space between because it's really about, hey, what are the what are the materials that you're using? They're not square. They're not rectangle. They're weirdly shaped. You can't quite fit them together, right? There's going to be structural issues With it. >> Even our programming languages are written by humans with

lots of historical issues um and backward compatibility and problems like that. Which is maybe also why you said to me as part of that conversation that maybe someday cyber security or or these like vulnerabilities will be a solved problem but only after we rewrite all of the programming languages or after AI rewrites all the programming languages. CISA and Microsoft and lots of other major companies even today are pushing people to use modern programming languages like Rust and away from C and C++ that give the programmer the ability to access memory outside of where they should.

So there's just these fundamental security issues in our programming languages um that make it possible for programs to be insecure. So yeah, absolutely. In order to achieve better security, I think we're going to Need to take a hard look at what our building materials and think about how we can use machines to start making 2x4s at scale. >> Interesting. I mean, this is all going to be have to be very metaphorical for me. So, we have Rust. Rust is a programming language created by humans, but you're talking about like does this actually make sense to

you that the AI will build their own programming languages to program in Eventually? >> Absolutely. I mean, what is the purpose of a programming language? It's it's really it's the interface between humans and the machines. So, we're trying to make it understandable to people, but as AI codes more and more, we won't need humans to have that interface again. Like, >> yeah, but like don't you want to be able to have somebody go in there and be like, "Oo, this this girder is in the Wrong place." I mean as a computer scientist I can say

I don't think one human fully understands how a whole computer works and operates and all the program we are we are well beyond that at this point in terms of level of complexity we're driving the car you know and it's what's under the hood is so incredibly complex >> nobody's going to go in there and figure out what's happening with that spark plug. >> Yeah. No one when it comes to computers. No, I don't think in the amount of time that you have in your lifespan that it would be possible for you to fully iterate

through and understand everything that is happening on your computer. >> But it sounds like you're saying that we will not just end up in a world where no one person understands all of the pieces, but where there will be some pieces that no person understands >> that are not understandable without machine help. Absolutely. Yep. Humans rely on tools. We just have to make sure they're reliable and working for us. >> Yeah. >> Is that Have you thought a lot about that? It seems like you've thought a lot about that. >> I'm a security professional. >>

Um you know the other thing I think about a lot and again I feel relieved That people are starting to think about vulnerabilities because again this has been an issue a pervasive issue for a long time. And when you say people, do you mean everybody like like me like like folks who have email, not folks who work at software companies? >> Yeah, exactly. I think in order to affect real change in our security, a topic has to be understandable broadly and people have to care about it in order to have legislation and, you know, Responsibility

appropriately allocated and funding and things like that. >> There are things that you there are laws that you would pass if you were in charge is what I'm hearing. I mean, I'm not that authoritarian, but certainly incentive. >> Yeah, there are laws that you would suggest that you would that you would build consensus around and that everyone would agree to pass together. >> Well, yeah. I think oversight and Auditing and, you know, disclosure because it makes me really sad. Again, I've been a professional pentester for decades or well, at least 15 years at this point.

Over and over, I see vulnerabilities that don't get disclosed. Um or there's something called responsible disclosure where you tell a vendor about a problem and you think uh because you're optimistic they're going to fix it and actually and maybe there's a whole bug bounty system Where you might get paid for it and often that bug bounty system is used like a gag order like researchers discover vulnerabilities and they report it to the vendor and the vendor says cool you've signed a confidentiality agreement here's your money now don't tell anybody about it and they can't tell

anybody >> right and that lasts for as long as that secret stays secret or for as long as no one else finds that vulnerability. >> Exactly. So, we've just been accumulating vulnerabilities for a long time and I'm excited that now there's momentum to do something about it. And the other big issue we could talk about is systemic risk. >> What's systemic risk? >> Systemic risk is the risk that permeates a system. And um I've been thinking recently about Dr. Dan Gear. I don't know if you've heard of him. >> I'm a big fan. He was

um he was fired From the company that he started in 2003 because he wrote a white paper um about cyber insecurity and the risks of a monoculture. And he actually lived um not too far from me in Cambridge, Massachusetts. And he was raising honeybees and he was really um interested in nature as well. And so the paper talks about how monocultures like uh the prevalence of the same code all over the place um means that we're at very high risk of a widespread problem. >> Sure. >> Yeah. So if a >> So if everybody's everybody's

router uses the same OpenBSD software and there's an OpenBSD vulnerability, suddenly every router is uh part of a crypto mine. >> Yeah. And these have real consequences that often people don't hear about. Like I did some work last year for a mental health institution that was hit with ransomware because of the Microsoft Exchange vulnerability and these have real life human consequences that you don't see in the news. You have a good instinct for cyber security but anyway I'm terrified. It's so scary. So can I before you get to your hope and I do want to

get to your hope um this monoculture thing is very interesting. This is what they say about voting machines where like America has 50 different voting uh systems which is nice because it means that like one Thing and also oftenimes like county by county it's different and so you don't have like one system that you can hack one way uh which which is a kind of protection and then also that made me think about the way that it feels a little like we might be headed into a world of much more personalized software. >> Yeah. and

and that that that might be good for security reasons. >> I was thinking the same thing. You know, It makes me think because right now if you find again a vulnerability in one product, it can affect millions of people. >> Um but we may be living in an age where like, hey, I want an app that does FU and in like a year and a half or two years, I might be able to just tell my AI friend to make it and poof, it's made. Right now, I actually have to like work out the bugs

in my vibe coding software. It's making me crazy. Um, but It might be really easy. >> This is the This is the vibe coding uh brain candy thing where it's like, "Ooh, you got 80% of the way there. That's very exciting." And then getting to 99% is is is like a a huge amount of work and then getting to 100% is that much work again. >> Oh, it's like I'm in college and I got in an argument with Claude Code and I was like, "Oh, hey, you put the wrong folder name here." And it was

like, "You Put the wrong folder name here." And I was like, "No, dude. You wrote that." >> But yeah, >> he's like, "I don't know what who wrote what. Look, I don't have contextual memory. Things don't exist to me, Sherry. >> I don't agree with all of the decisions that Claude Code is making." And you got to like double check it. >> Oh, for sure. >> But I'm hopeful because with this age of Personalized and customized software, maybe we can use AI to reduce monocultures and to add more diversity and that could reduce risk associated

with other types of security problems. >> And that's interesting because it's it's not saying that there's not going to be bugs in that code. There's going to be bugs in that code. It's saying if the danger of a bug just increases exponentially with the number of people using that software. And if it is if it Is one, then it's really down to how much someone wants to hack you specifically rather than someone using uh you know an exploit that came out and and then they can sort of hit you know 30 hospitals in one day.

>> Yeah. I mean are we going to hack BSD or are we going to hack Microsoft Windows? Um where are we going to invest those resources >> or are you going to hack like Sherry's customuilt CRM? >> Don't do that. Don't do that. >> Well, I mean I do think that it's it's something to be concerned about. It's it's not like uh AI is great at security. Well, I guess it maybe it will be eventually, but like right now cloud code isn't thinking uh through all the different implications of all the strange decisions it's making.

I I imagine >> I have a second AI that I use to check the first AI which I think has been Helping a lot because it'll be like you know tell it to do blah blah blah differently and I'm like okay thank you. As a person who is uh mid-career, how do you feel about what what would it be like different for you if you were doing this if you were starting your career now >> in cyber security? >> I don't know like what whatever you were up to when you graduated. >> I mean, it's

interesting. I think Everybody in computer science is who's in it right now is probably questioning that. Um there's a lot of software developers that might be trying to figure out next steps in their career or looking at new fields potentially because claude code and other tools are getting so good at v coding and a lot of it is more like understanding the needs of the business and making sure your UI is really solid and things like that. >> You think cloud's bad at UI? No, no. Cloud isn't bad at UI, but you know, you the

human have to guide it and tell it what you want. >> You you actually know what a human like what you want the the tool to do. >> Correct. That also introduces other problems which could potentially be job security for some people. You know, the the risks of malware being introduced through vibe coding tools um is very real. The Amazon Q AI tool uh software um >> what's that? I don't know what that is. So, Amazon um had a has an AI tool, Amazon Q, um for vibe coding and um I believe it was being

managed through GitHub and some unauthorized user got access and planted malicious code which was deployed to over a million developers and the intent was to wipe people's hard drives. Fortunately, it did not work. But I think it's pretty scary that this was not detected by a major company. And one little Configuration flaw in um the code management system could potentially uh lead to unauthorized access and then deployment of unauthorized code to thousands or millions of people. >> Damn. Um it sounds should I expect well I guess the broad question here is is there something that

I should be doing? Is there something that people watching this should be doing? is the like is the vulnerability landscape changing dramatically enough that we need to be Acting differently than we were two years ago. >> I think one thing is it's important to take advantage of resources they have and I consult for businesses. Um and actually tomorrow I'm going to be recording a podcast for my clients and community and I need to provide clear takeaways, actionable takeaways. And I think we're living in an age where if you have software developers in-house or if you

rely on any third parties, they Must be using AI. Um, you have to be using AI to check your code. Uh, and in some cases, if they're already using AI to create their code, um, which has its benefits, make sure that they're using it in intelligent ways and that they're really paying attention to the software development piece of it. So is there is there like a for people creating code there is there like a security type step that one would want to be using? >> You've probably noticed lots more Updates than you used to are

coming from software development companies, right? So you might be getting new feature, new this, new that and that's happening because more companies are vibe coding and that's cool. >> So there's new features being launched. That's not because they're saying, "Oh, we patched a bug. Oh, another bug that we found that we patched maybe also that quite fingers crossed." >> Oh yeah, hopefully. But they're also Really excited to these new features available. They have to stay keep up with their competitors. So we're going to see new features coming out rapidly as well, which means of course

more bugs and you want to make sure they have a secure software development life cycle. And Hank, a lot of companies do software development that you might not expect. Um, some of my clients that do tons of software development, for example, are banks and credit union. >> Sure. Yeah. >> Um, they often have in-house developers to make custom tools. And so you know they need to have mature software development life cycle or that company you've hired out of India to make that web application. Um you need to make sure that you're looking under the hood

at what that vendor is doing. >> For clarity I have not hired a company out of India to make a web application >> yet. Yeah. I Yeah. No, I'm not going to cross it off the list of things I might do. This is not a thing I expected you to say but it sounds like um there are just a lot of there are a fair number of zero days. There are also a bunch of like known bugs and exploits and vulnerabilities that are unpatched. Um, and also like you know anytime there's people who just aren't

uploading updating their software, make sure you update your software everyone. That's my Tip to you. People aren't updating their software. People uh you know it's it's it's complicated. Maybe the IT department uh is is very stretched thin. Um, I didn't I didn't think that the problem would be, "Oh, we found the bugs." Um, and we didn't do anything about them. I thought the problem would be, "Oh, there's going to be a bunch of bugs that keep getting found forever." But it sounds like it's both of those things. >> Oh, yeah. It's such a hard problem.

There are so many bugs that just have been getting dusty for years and years. And that's always been the case. >> Some of them are. It's hard sometimes. Like, you got to have your software like still work after you fix the bug. And that might mean still interfacing with a bunch of different systems that you don't control. >> And people are afraid to to apply patches. Like again, I had a another Client that was afraid to apply the Microsoft Exchange patch. Waited like six hours. That's it. And they were already hacked by the time they

applied the patch. Um, so because you're like, I want to test this. Um, when I worked at the Children's Hospital in Boston, we would have a whole testing process because, you know, I mean, it's life or death around a hospital. You don't want your systems to crash, but we don't always have time to do that. >> Um, I started using a term recently that I'm really excited about. Hank, can I tell you what it is? >> Um, negative days. We hear a lot about zero day vulnerabilities, also endday vulnerabilities that have been around for a

while. But just last month, I wrote a blog and I was like, we're dealing with negative day vulnerabilities where they're getting hacked. Like people are getting hacked before anybody even actually before the Vendor knows about the vulnerability. It's just out there. Well, I mean, that's what I always sort of imagined a zero day to be, but I guess it can be a zero day for more than one day. >> Yes, exactly. People are just getting hacked and don't even know it sometimes for months. >> It does freak me out. It seems like a big deal.

It it also seems like you're making me feel very much like uh we're we're we're in the baby days of Software, which is not which is not how I think. You know, I think that the baby days of software were like cobalt or punch cards, but in fact, like this might still be the baby days of software and Yeah. >> What was the baby days of again building houses? We had like yurts and tents and all kinds. >> Yeah, I guess it was a while before we got to >> a while. We learned a lot.

I am so Excited about two 2x4s and having machines that can create them rapidly because we are going to build some really cool stuff and we're going to get to a whole new level of engineering and things that humanity can do. >> I don't talk to a lot of people who are like immediately uh I don't know it seems like you're optimistic about AI. I'll hit you with a thought that I keep having which is I did not realize how software constrained the world was. I Assumed that we had the amount of software that we

needed. But in fact, what appears to be the case is that if you can create 10 times more software, we need 10 times more software. Which indicates that if you could create a 100 times more software, we might need a hundred times more software. And if you could generate a thousand times more software, we might need a thousand times more software. And we just didn't know that because we were constrained by like It being written by people. >> I have been waiting for technology and software to catch up for so many years. I remember when

I started my business in 2009, I wanted a learning management system and they barely existed at the time and I wanted project management systems and they were crappy at the time. And all of these things that exist now are beautiful and um we could have so many more customized so it integrates into our organizations and our lives at A >> Aren't you terrified of that as a security professional though? like that. Like who's going to pentest everything, you know? If if if there's if there's a thousand times more software, there's a thousand times more bugs.

>> AI pentesters. >> Yeah, that's if you're putting yourself out of the job over here. >> Oh, I don't think I think there's still going to be a level like right now. AI Pentest tools are hilarious. Um or >> but I mean it sounds like Mythos is a pretty powerful AI pentest tool. >> Well, and it's amazing how far AI tools have come in the past year and a half. Like when I did this research and presented at RSA, we were researching AI tools on the dark web late 2024, early 2025, and they came up

with exploits, but our pentest team was like, h, we'd have to change some stuff for it to work. And it sounds like now it is. >> So So you were actually using this worm GPT or whatever. And it it did succeed in finding some vulnerabilities for you, but not like out of the box useful. You actually had to know some stuff to use it. I mean it was useful like we analyzed Magento for example which is a popular e-commerce site and we had it scanned for vulnerabilities uh and we found it it's open source we

found some vulnerabilities and we said write us an exploit and again Tom our head of Pentest and this was by the way Matt Duran was my co-author on this project and did a lot of the work just to give him credit that he deserves. Um my uh Tom who is our head head of penetration testing had to go in and tweak some stuff for the exploits to actually work. Um, and I was irritated at the time because I wanted the AI tools to be better. Now they are and they don't all have the same ethical

constraints that Anthropic has, you know, making this. So, keep that in mind. Like, you know, we have Anthropic making this big announcement. Who's to say China doesn't have the same capabilities? Who's to say that some uh, you know, um, some organized crime group doesn't already have something like this? So, keep in mind they're not the only ones developing these capabilities. >> It did also occur to me that the U recently the Department of Defense was like, "We don't want to work with Anthropic anymore." And and I'm like, "Well, I feel like maybe it would have

been nice to be working with the company that can hack everything. >> If you're the Department of Defense and you're getting ready to uh be in a cyber war with uh half of the world, that's a I just scared myself talking out loud. >> Don't be as scared. I used to be smart as a security professional because I saw so much that I couldn't talk about and you know even and can't talk about Today. Um but at a certain point you step back and realize like we're all going to die anyway. Um so >> yeah

Sherry that made me feel way better. >> I think that what's going to happen is going to be way different than what anybody predicts. That's the one thing that I'm predicting. >> I agree with you there. I agree with you there. And I think that it's very hard to remember that lesson even though we Learn it every time some big new technology comes along. Um, am I about to get a bunch of like software update notifications? >> Be prepared for that because number one, you're going to get feature updates. Hopefully a bunch. I bet it'll

be exciting, but yeah, you're going to almost certainly see a bunch of bug bug fixes. Probably way more critical bug fixes maybe than we've ever seen. We'll see. >> Are these people going to be totally exhausted? It sounds like sometimes these bugs just sit around. Um, and maybe they're not that critical. Maybe, you know, they don't affect that that many people, but are are these people now going to have to just sort of like put their nose to the grindstone and be like, "Okay, we have a thousand bugs we need to fix, like we have

a thousand critical zero day security vulnerabilities." My hope and Expectation is that along with project glasswing um we're going to also see development of AI tools to fix bugs so that we can fix them so much more rapidly than ever before. I'm guessing that's going hand inand with the launch of this, right? Don't you think? >> Yeah. I Yeah. Yeah. Yeah. And I think that they even like with FFmpeg they handed over a patch along with the bug. So they were like we found this bug, here's the patch. Uh they didn't even Make FFmpeg fix

it. The hard part will be testing. Testing to make sure that after you make these code changes, the software still performs the way you expect. >> I hate that, Cherry. That that that makes it that makes it sound like it's going to be hard. I just want it to be all the bugs to go away and I want everything to get fixed. I >> You're so crabby when you're sick, Hank. >> Look, maybe that's what the problem is. >> I think it's funny we're talking about this while you have a virus. you're but I am

I am somewhat surprised by your level of hope because I I've talked to you and there are certain things that you are very uh pessimistic about like you're angry that things are set up the way that they are often you find that I I often find that there's like some like thing that I think is a normal function of society in the universe where you're like I cannot Believe that we're being mistreated in this way as a society. credit card use I think is one I the way that credit cards work in America being one

of them >> started >> I know I have before >> uh but it it it seems it seems like you think that we're going to be able to get to to make our way through this >> I've been very stressed out since 2010 when the operation Aurora attacks hit um because tech companies were getting Hacked and compromised and source code was getting leaked and therefore in the hands of malicious actors And that meant that vulnerabilities were getting stockpiled and nobody was talking about it. And so I feel super relieved that this is out in the

open and it's now going to be something that we have to deal with. Software vulnerabilities and software exploitation are the number one cause of um of compromise today. And so if we can actually tackle this together Um openly and address it, that's going to make all of us more secure in the long run. Do you are you glad that it was Anthropic that got this first? >> I don't know if they got it first. >> Well, that's an interesting way to end the conversation, >> but I'm glad you published it. I think there's pros and

cons. Um again I think those there needs to be a concerted effort to secure help researchers gain That access project glasswing to remain secure themselves and to report any leaks or inappropriate access to the glasswing to project glass wing and the tools. >> When do you think uh you get access to it? >> I don't know if I want access to the mythos preview or to project glasswing >> because you don't want to be a target. >> Correct. I think that's a lot of responsibility and I have other projects I'm excited about. >> What are

you excited about right now? >> Oh, I can't tell you yet. >> Oh, Sher David off LMG Security. Thank you so much for spending some time with me. >> Oh, thank you so much. I really appreciate it. It's always fun to be on. >> That conversation did not go how I expected. It is now the next day. I know I'm wearing the same clothes, but it's now the next day. I've been thinking About it ever since. I hope that it uh sparked some sparks for you as well. Last time I had Sherry on, people were

asking, "How do I get more Sherry?" She has a podcast and I will link to it in the description. And also again, if you want to spend some more time in your own mind exploring this part of stuff that nobody can hack, you know, The Book of Good Times is available. There's a link in the description.