AI-Enabled Cybersecurity (The Derby Mill Series ep 35)

Earlier this month, JPMorgan CEO Jamie Dimon remarked, “I wrote about cyber this year. I said, and I meant it, it’s our biggest risk. And that was a couple weeks before Mythos. And now it is our biggest risk by far.”

Then last week, The Wall Street Journal ran the headline “AI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk; Artificial-intelligence tools helped find one of the most severe online bugs ever. Cyber experts are racing to patch it before hackers use AI to exploit it.”

Cybersecurity researchers, the accompanying story noted, had issued an alert about two AI-uncovered vulnerabilities in PHP (PHP: Hypertext Preprocessor), a programming language that powers most of the web, including WordPress and Wikipedia.

The same day, The Information reported a totally separate cyber attack: “A hacking group called CyberCartel used a web of AI agents powered by models from companies including Anthropic, SpaceX and Chinese lab Moonshot AI to automate cyberattacks against more than 400 Latin American financial targets, according to an investigation by the cybersecurity startup Straiker.” Two days later, The Atlantic ran the headline “Welcome to the Valley of Pain: An explosion of AI-powered hacks will reshape life online.”

All this was forecast at Intrepid’s June annual general meeting in London. The Derby Mill team and Gianni Cuozzo, the CEO and founder of Rome-based Exein S.p.A., an Intrepid portfolio company that produces cybersecurity software for AI-enabled physical connected devices, anticipated the coming surge in cyber attacks.

Recent advances in AI lower two costs that increase the likelihood of cyber attacks: 1) they drastically lower the cost of finding vulnerabilities in code, 2) they severely lower the cost of exploiting those vulnerabilities. While advances in AI also lower the costs of cyberdefence, the impact is not symmetric. The reason AIs advantage attackers more than defenders is due to their unpredictable error profiles, which are less problematic for attackers.

Sendhil Mullainathan summarized, “Both the discovery and the exploit [of the coding flaws] are now about to get orders of magnitude much bigger. So if you think of a tail risk for the entire economy, this type of thing is sitting on that. You could imagine an attack on the New York Stock Exchange that caused chaos or rewrote trades even just for 5 minutes…. it’s arguably the biggest near-term threat that is not really described because you forget how much of the economic system, the medical system, everything relies on technology.”

FEATURING

Gianni Cuozzo, founder and CEO, Exein S.p.A.
Ajay Agrawal, co-founder and partner, Intrepid Growth Partners
Sendhil Mullainathan, senior advisor, Intrepid Growth Partners, MacArthur Genius grant recipient and professor, MIT
Niamh Gavin, senior advisor, Intrepid Growth Partners, Applied AI scientist and CEO, Emergent Platforms

LINKS

Find Exein on the web. Context on their $270M raise, led by Headline with participation from Intrepid Growth Partners and others, at a $1.7B valuation for building the security layer for physical AI. Report on the round from the Financial Times. Intrepid’s report.

PHP vulnerability context from the BBC, the SANS Institute and the New York Times.  

Hugging Face incident context. MIT Technology Review. OpenAI’s take. Op-Ed from The Guardian. Commentary from WSJ.  

Derby Mill’s previous conversation with Gianni Cuozzo, which predicted incidents like Hugging Face. 

Subscribe to The Derby Mill Series at our Substack (main site) or on YouTube, Spotify or Apple Podcasts 

Derby Mill is created by the team at Intrepid Growth Partners and produced by Ghost Bureau. 

‍

NUGGETS

The future of cyber attacks

Is AI’s ability to discover and exploit software code security flaws the biggest under-the-radar near-term threat to the economy?

‍

Why are LLMs naturally skewed toward attackers?

Intrepid advisor Sendhil Mullainathan breaks down the asymmetry. 

‍

How AI-generated code will change cyber attacks

At this point, the flaw in the workflow is the human, says Sendhil. 

‍

A better way for governments to tackle cybersecurity

Can government funded bounties build a stronger white hat hacking community?

‍

DISCUSSION POINTS

00:00 Cold open

00:40 Exein Origins

06:41 Agnostic Architecture

08:03 Product Ecosystem

09:22 Machine-Based Ransomware

11:44 AI Agent Communications

14:03 Escalating Tail Risks

18:44 On-Device Embedded Security

21:39 Embedded System Vulnerabilities

24:02 Audience Q&A

25:50 Market Demand Dynamics

27:12 Azure Container Incident

32:00 White Hat Hacker Bounties

33:08 Asymmetry in LLM Capabilities

36:06 Real-Time Processing Constraints

39:34 LLM-Generated Code Vulnerabilities

41:40 Long-Term Horizon

DISCLAIMER

The content of this podcast is for informational and educational purposes only and should not be construed as marketing, solicitation, or an offer to buy or sell any securities or investments. The opinions expressed in this video are those of the participants and do not necessarily reflect the views of Intrepid Growth Partners or its affiliates. Any discussion of specific companies, technologies, or industries is for illustrative purposes and does not constitute investment advice. Viewers are encouraged to consult with their own financial, legal, and tax advisors before making any investment decisions.

‍

‍