Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.
Start free trial →Decoder with Nilay Patel · Tech Strategy & Big Tech · November 2026
Stamos argues every company needs to run an AI attack tool against itself within months. He says corporate risk and legal processes make that hard for big organizations, while attackers face no such friction.
Yeah, I totally agree. So I'll give you a very practical example of a way CISOs and their bosses are going to have to change on this. Every company in the next, I was going to say six months, but really in the next 90 days is going to have to R-Tex themselves. You're going to
have to run the attack on yourself.
Yes. If not with real R-Tex, you're going to have to use a AI red teaming product that is functionally equivalent, or you're going to have to hire a company to do that for yourself. If you do not, you will get breached. Yeah. It just terrifying, right? Because these things are completely non-deterministic by definition. They're very smart. They're very fast. They are so fast that no matter what, if you hire like an AI pen test, AI red team company, they will promise you verbally, oh, it is completely safe. And then they will give you a contract that says our product will give you cancer, will emanatize the escaton, and will likely end the human race. And you hold us harmless when any of these things happen, right? So there is a disconnect between what they will say verbally to you and what their lawyers have written, right? Because that company has, by definition, only existed for six months, or at least the product has existed for six months. If it is an older company, they have no idea what their product is going to do when it meets your software. They have no idea, whatever they say to you, but you have to do it because some dude is…
Support for the show comes from CrowdStrike. Here in Decoder, we're peering beyond the traditional tech realm and into all the places AI is shaking things up. Cybersecurity is key to that conversation. CrowdStrike gets that. That's why AI Detection and Response or AIDR is emerging as a new category…
There are several costs associated with this. And one I think is just like the most common in business, which is, well, if we find out there's a problem, we'll have to pay to fix it. So what if we just wait? Right? Like you can see that coming. What if we find out that we are catastrophically in…
couple of things. One. I