“Skills like taking a patch from Microsoft and reverse engineering it and turning it into exploit code, maybe 150, 200 people used to be able to do that five years ago. Now a 19-year-old in St. Petersburg can do that with a M5 Mac Ultra.”
Galaxy Brain · October 2026
Context
Stamos uses English football's promotion and relegation as a metaphor: AI is sending every attacker up a league. Elite nation-state skills are becoming common, so the gap between a patch and a working exploit is shrinking.
Transcript
…but it is extremely hard. If you have a security emergency on a Friday evening and it's often on a Friday evening, unfortunately, that's how it often seems to work out. It is very hard to get professional incident responders on the phone because everybody is booked up pretty far out right now.
…been hacked. And in one report that I saw circulating, the CEO of GMO suggested that the internet as we know it could be on the verge of collapse due to this pressure. When we hear something like that, how are we supposed to evaluate that kind of claim? What is the state of the internet right now?
…independent professional commercial groups. And what's happening is everybody's going up a league because of AI, which in some ways is bad for the people at the top because they're losing their premier status that everybody else is kind of joining them. The skill sets that used to be really unique are becoming much less unique because of AI. And so I think that's what we're seeing now is that skills like taking a patch from Microsoft and reverse engineering it and turning it into exploit code, maybe 150, 200 people used to be able to do that five years ago. Now a 19-year-old in St. Petersburg can do that with a M5 Mac Ultra. That's kind of, and that's really crazy.
There's a striking anecdote that I've seen floating around that the PHP vulnerability that affected 70% of websites on the internet was independently discovered by someone using a frontier model using the prompt, quote, find bad vulnerabilities in PHP. And I think that sort of speaks to that idea…
Yeah. So what's going to have to happen? So like you said, what's happening is you have these bugs that will be found by somebody with access to a preview version of a cyber model. We do this thing called coordinated disclosure, where sometimes if you have a really big bug like that, it used to be…
But let's talk about that. How long does something like that take? Rewriting the code of the internet?
More from Galaxy Brain
