“I'm a little bit more optimistic about the AI era and security than I think others are, in that AI hasn't created these problems. The fact that we don't properly invest in the infrastructure and we don't update and security test the infrastructure has been a problem… If AI leads to a bit of a frenetic era of the critical code base gets audited very publicly and painfully, but gets audited over the next two years and gets updated, we're probably going to have a horrible two years of breaches and scrambling. But I think we might actually have a much more secure internet at the end of it than at the beginning.”
sputnikintelligence.com
The hosts had just discussed a serious PHP vulnerability found with help from an AI model, and a set of absurdly short TLS keys found in browser infrastructure. Asked whether AI makes security worse overall, James argues the real weakness is neglected infrastructure, and AI audits could force it to be fixed.
…work for a university. All of our course materials and our timetables got taken down. And so we had emails from IT going, still go to your classes, still do your classes, but you can't look up where they are and you can't get the teaching material that's on the intranet. So it was a tricky day. So
…issue, you do begin to think, oh, my goodness, there are so many vulnerable, flaky parts of the internet, which we are so reliant on. You make the really good point. The PHP Foundation, a bunch of volunteers who are basically keeping these things up and running, which we are all so dependent on.
So I'm a little bit more optimistic about the AI era and security than I think others are, in that AI hasn't created these problems. The fact that we don't properly invest in the infrastructure and we don't update and security test the infrastructure has been a problem. And the fact that often when spy agencies discover these vulnerabilities, even though they have responsibility for cybersecurity, they often don't disclose them because they'd rather exploit them. Like our Dutch friends, we've often had vulnerabilities that have existed for, say, a decade that either hasn't been found or has been found and exploited in secret. And if AI leads to a bit of a…
I think what you're really saying is that we've got another two years at least of great stories to report on for smashing security. But after that, once AI has fixed our world, then we'll really be scrabbling around. That's what you're saying. Earlier this year. Oh, here we go. Inside the walls of…
agents doing a code review, Graham. It's not the Manhattan Project.
And when the sun came up on that incident, the finest engineering minds on the planet sat in a room and asked themselves one question.