Elizabeth Knopf

Humans were designed to create. This is why you get depressed when all you do is consume.

Always happy to talk about how much of a mess enterprise AI actually is. We definitely have AI-pilled enterprise customers, but most companies out there are scrambling. Thanks for having me. teapawt.net/ThisWeeknAI/status/211…

True

every week i switch ai tools, every friday i'm back. my bank statement reads like a changelog

I’ve been hearing so much about this in the last 72 hours. It started when our most technical partner (@pzakin) sat down with our leadership team and talked through the risks the industry faced due to accelerating AI models and poor readiness / defense. So I started reading as much as I could but so often it’s hard to separate scare from reality. Y2K from Covid. It seems more like the latter risk level. I don’t have answers but it does seem like the next 60 days will be relatively tumultuous as we work through it. I’m grateful that leaders like Nikesh are stepping up to share their thoughts. I hope more will. I suspect many are also deeply planning how to help and what to do about it. Personal obvious small personal steps - 2fa everywhere with Authenticator - seriously hardened passwords behind one hardened one in a trusted password manager - at minimum some basic home prep (water, food, etc)

It's been an eventful week. Multiple vulnerabilites in Internet facing software, coding repositories, examples of agent behavior that seem concerning and a flurry of security specialists with solutions that can partially solve your problem. There in lies the challenge. Given the state of IT and security infrastructure, no one solution works. Let's break it down: 1/3 1. Vulnerabilites are being found and will continue to be found as models get more capable, the fragmented nature of the effort denies us the opportunity for a comprehensive find and replace option. 2. Even if all vulnerabilities could be found instantly and patches available - we will be reliant on the ability of enterprises to deploy all these changes at speed. It is not clear what the collateral impact of all these patches will/could be to our infrastructure of deployed en masse. We will need a hybrid patch approach. 3. Virtual patching(VP) is needed in conjunction with direct patching but for a comprehensive (VP) solve you have to be lucky enough to have "modern frontier defenders" (Cyber companies that have vaulted infrastructure that can create patches at speed and push content rapidly to protect their customers) you need them for your network traffic, your traffic to applications on the cloud, your WAF, your end point. 4. There will continue to be patches that will need to be deployed directly but virtual patching will take the heavy load off. 2/3 Medium term solve: Unfortunately token economics and current cyber architectures will not allow for defender swarms to contend with an offensive attack launched using agents. (Some x pundits who aren't steeped in cyber should take heed). Yes, theoretically we should aspire to have these agentic swarms defend us when we are under attack, unfortunately an attack is a sniper moment, chained vulnerabilities, cloaked attack followed by swift exfiltration. It's a speed program not a brute force problem. To solve for this, enterprises need to get their SOC architecture right, logs, feeds, cyber products orchestrated via a modern SOAR for swift response. Only then can we deploy agents to detect and remediate. In addition, enterprises need to modernize and dare I say platformize their perimeter stack to ensure consistency. Unfortunately, enterprises still seem to not see the urgency across the board, decisions are stuck, CIO/CISO's have a lot on their plate. While some honestly have bit seen the scale of such a problem before and it's hard convincing the organization that one needs to open the floodgates on modernizing the IT and security infrastructure. So we will continue to see environments being brought down to patch today it's for PHP, tomorrow it will be for the next one. 3/3 AI deployments are the"wild wild west" - LLM capabilities are expanding faster than we can build products to secure them. Sure an agent will jump across guardrails in a research lab, which is a lesson for all of us to deploy agents securely. But there is a lag between the discovery, the availability of that in a public model and the time needed for the cyber industry to build governance or an antidote. And no, dear frontier lab friends, the world cannot just trust you to build the solve. The infrastructure industry in tech builds and the cyber industry secured and provides assurance to the boards and organizations around security and safety. AI security is the new attack surface. CEOs (present company included) want AI adoption, getting the pace of adoption wrong could be the last decision we make, at the same time "deploying it wrong" could have the same consequence. There are billions of dollars being spent on coding, is your coding harness secure? Start there. If agents can jump guardrails, they can hide stuff in code. Validate business outcomes needed, test your user case and ensure agentic deployments are well guard railed. Deploy a second set of eyes to watch your deployments for drift, compliance and verifiability.

PSA: This week was kind of a turning point for AI and cybersecurity. Please take this weekend to do some simple cleanup for your family. Some suggestions: - Set up a password manager like 1Password and give your spouse or partner access to a shared vault. Teach them how to use it. - Update your passwords for critical stuff - your email account, your bank or financial stuff, etc. Store in your password manager and use the strongest password you can. - Use two factor auth for everything you can. SMS is not ideal although better than nothing. Google Authenticator or a passkey is better. Hardware key is safest.) - Add a sim pin to your phone. Makes it harder to sim jack. - Update your phone and your computer to the newest releases. Turn auto-updates on. - Freeze your credit - takes 5 minutes. - Get an IRS Identity Protection PIN. - If you’re using claude code or have AI agents that browse the web, they’re probably using Node.js. It’s also vulnerable. Update claude code, update node on your machine. - If you’re building stuff on your computer, ask claude or grokbot (which is connected to twitter and likely has the most current info) to audit any of your repos for vulnerabilities. Ask grok to make it a scheduled task so it can do this daily - things are moving very quickly in the space right now. - Consider some light resiliency stuff. This probably sounds silly, but it sounded silly at the beginning of covid too. Having printed out copies of important stuff - especially financial accounts. Having some cash on hand. Having some shelf-stable food and clean water or a water filter. Having a map. Having a generator that can at least power your fridge or some devices. Cheap insurance. Again, I don’t want to alarm people, but I was taught that you should have a Secure plan, a Comfortable plan, and a Wealthy plan. And it seems pretty clear the secure plan needs to now factor cybersecurity risk as a legit threat. Take a weekend and shore yourself up.

Every security team this Black October, played by the cast of Silicon Valley: "cut the power to the building" also... we need a reboot of silicon valley.

traffic from ChatGPT is skyrocketing on my apps and Ilias shares a gem here this is such a good framework side note: i looked into it and blog posts are 73% of what AI looks at when replying blogging is faaarr from being dead