Podcast Wiki

AI and Cybersecurity

5 min read

Summary: Frontier models are getting much better at finding vulnerabilities, which erodes cybersecurity’s old premise that scarce expert knowledge can be packaged into products that protect people who lack it. Code is now written faster by agents, legacy is vast, and attackers use LLMs and agents too: reported attacks already ran end to end through an agent, and one unskilled, motivated person can now do what took a skilled team. Defenders answer in kind with continuous automated testing, fast remediation, protections shipped in under an hour, and behavioral and agentic defenses that look at the pace and shape of activity. Protocols don’t change, so attacks still look familiar, just faster. How labs should release cyber-capable models is contested (restricted access versus broad verified access), and demand for security is expected to rise.

Key ideas

  • Traditional pentesting comes in two forms: external audits for compliance (a two-week engagement ending in a PDF; expensive, infrequent, and dependent on the team’s day) or scarce internal red teams. Neither scales to agent-speed code (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • Model capability in finding vulnerabilities rose faster than the Tenzai team expected; the same evolution was visible before Mythos (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • Two things can be true at once: models are genuinely improving at offense, and Anthropic’s restricted Mythos rollout (Project Glasswing, select US companies) is a marketing masterstroke built on scarcity (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • Gurevich’s view on access: restricting defenders while capable models leak or exist elsewhere hurts safety. Prefer KYC-style identity verification and accountability (OpenAI’s trusted-access program) and broad access for defenders. Security-through-obscurity has failed repeatedly (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • Model differences plateau: vulnerability-finding curves level off at similar heights. Harness and token budget matter as much as the model, and he rated GPT-5.5 under trusted access above Opus 4.8 at finding vulnerabilities in code (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • A coming cleanup era, similar to the early Windows worm era: many critical bugs found, then the internet gets cleaner. What matters is time to find and time to fix (in code or at an intermediate layer) (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • Host’s analogy: a good lock used to stop opportunistic burglars; now opportunists may get professional-grade tools (ignore-instructions—26-ai-cyber-pavel-gurevich).
  • Many real findings are business-logic and integration gaps (microservices wired wrongly, infrastructure config, double-spend style flows), not classic coding mistakes (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • Security demand grows while the case for buying generic SaaS weakens: companies can build more themselves, but cyber risk only rises (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • Open-weight models are what matter about “Chinese models”: US companies are also working on strong open models, and broad openness with incremental capability helps defenders keep up (ignore-instructions—26-ai-cyber-pavel-gurevich, pavel-gurevich).
  • Government and critical-infrastructure defense adds constraints: on-prem and air-gapped deployments without cloud monitoring, demanding customers who want every failure explained, and a high cost per bug (sometimes a flight to fix it) (hidden-layers—dream-eran-hoffman, eran-hoffman).
  • AI commoditizes attackers and turns zero-days into hours while patching can take months, so defense must respond faster and grow more autonomous: “don’t bring a knife to a gunfight”. Containment should be fine-grained (block one rule or endpoint) rather than “disconnect everything” (hidden-layers—dream-eran-hoffman, eran-hoffman).
  • Cyber-physical systems (hospital devices, factory robots, data-center power and cooling) are increasingly network-connected, so the risk is physical harm, not just data loss. Defense starts with a precise inventory and behavioral baseline of every asset; AI-lowered attack barriers make knowing your own “home field” matter more (hidden-layers—claroty-ben-mashiach, ben-mashiach).
  • Finding is no longer the bottleneck; fixing is. Useful tools now hand coding agents full remediation context and apply temporary mitigations through existing security tools until the real fix ships (hidden-layers—tenzai-ofri-ziv, ofri-ziv).
  • Agentic attackers are already in the news: a Ynet-reported ransomware attack entered via a CVE (a Langflow vulnerability was also exploited by an agentic attacker), found keys in a database, encrypted the data, and demanded ransom, all driven by an agent. Investigators spotted it from the code’s detailed, agent-style comments (hidden-layers—cato-networks-avishai-zvinsky, avishai-zvinsky).
  • Attackers are human too: someone has to give the attacking agent context and train it, and that agent blundered by asking for ransom to a generic example Bitcoin wallet. The fear-mongering tone overstates it, yet the fear is justified: one case fixed script errors on the victim’s machine in 31 seconds, so the 12-hour response windows defenders once allowed themselves are gone (hidden-layers—cato-networks-avishai-zvinsky, avishai-zvinsky).
  • Protocols stay the same (TCP, UDP, Active Directory logins), so agentic attacks look like familiar attacks at a different pace and with more on-the-fly course changes. Inhuman speed can give the attacker away (hidden-layers—cato-networks-avishai-zvinsky, avishai-zvinsky).
  • Cato built an agentic attack lab: an agent drives Kali Linux, a distribution bundled with pentest tools, against a lab network, given a goal, background, and an entry point, so defenders can study the agentic modus operandi (hidden-layers—cato-networks-avishai-zvinsky, avishai-zvinsky).
  • Behavioral defenses watch pace and attack sequence, not just signatures. A coming in-line defensive agent watches each customer’s traffic over time and tightens restrictions on a device at early signs, e.g. someone in sales running PsExec (remote code execution across Active Directory: fine for IT, loved by attackers, so not blocked outright) (hidden-layers—cato-networks-avishai-zvinsky, avishai-zvinsky).
  • Democratized attack: Zvinsky expects massive “exploitation of stupidity” by agents that quickly produce good-looking output, cheaper models, and fear-mongering that is nonetheless justified. The host adds that targets once “not worth the hassle”, like the website of someone you argued with on the road, are now in reach (hidden-layers—cato-networks-avishai-zvinsky, avishai-zvinsky).

Disagreements & open questions

  • Restricted release vs broad verified access: the host argues that with very high-stakes capabilities (state actors), caution and responsible-disclosure-style delays make sense; Gurevich counters that selective early access isn’t disclosure and leaves most defenders blind (ignore-instructions—26-ai-cyber-pavel-gurevich).

Takeaways

agent-security · harness-engineering · open-weight-models · ai-verification · ai-red-teaming · agentic-vulnerability-response

Graph View

Backlinks