Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.

Start free trial →
AS Alex Stamos On Decoder with Nilay Patel

“A ton of companies are going to get breached by some 19-year-old running Artex and then buying tokens off OpenRouter or running it locally on their gaming PC, right? They're going to turn off Call of Duty, run Artex, then turn Call of Duty back on, right? And while they did that, they broke into a bank whose policy said, oh, we can never red team ourselves.”

Decoder with Nilay Patel · Tech Strategy & Big Tech · November 2026

“A ton of companies are going to get breached by some 19-year-old running Artex and then buying tokens off OpenRouter or running it locally on their gaming PC, right? They're going to turn off Call of Duty, run Artex, then turn Call of Duty back on, right? And while they did that, they broke into a bank whose policy said, oh, we can never red team ourselves.” — Alex Stamos, Decoder with Nilay Patel

Context

Stamos argues every company needs to run an AI attack tool against itself within months. He says corporate risk and legal processes make that hard for big organizations, while attackers face no such friction.

Transcript

Decoder with Nilay Patel Around 25:12 into the episode
Alex Stamos

Yeah, I totally agree. So I'll give you a very practical example of a way CISOs and their bosses are going to have to change on this. Every company in the next, I was going to say six months, but really in the next 90 days is going to have to R-Tex themselves. You're going to

Nilay Patel

have to run the attack on yourself.

Alex Stamos

Yes. If not with real R-Tex, you're going to have to use a AI red teaming product that is functionally equivalent, or you're going to have to hire a company to do that for yourself. If you do not, you will get breached. Yeah. It just terrifying, right? Because these things are completely non-deterministic by definition. They're very smart. They're very fast. They are so fast that no matter what, if you hire like an AI pen test, AI red team company, they will promise you verbally, oh, it is completely safe. And then they will give you a contract that says our product will give you cancer, will emanatize the escaton, and will likely end the human race. And you hold us harmless when any of these things happen, right? So there is a disconnect between what they will say verbally to you and what their lawyers have written, right? Because that company has, by definition, only existed for six months, or at least the product has existed for six months. If it is an older company, they have no idea what their product is going to do when it meets your software. They have no idea, whatever they say to you, but you have to do it because some dude is…

Speaker 4

Support for the show comes from CrowdStrike. Here in Decoder, we're peering beyond the traditional tech realm and into all the places AI is shaking things up. Cybersecurity is key to that conversation. CrowdStrike gets that. That's why AI Detection and Response or AIDR is emerging as a new category…

Nilay Patel

There are several costs associated with this. And one I think is just like the most common in business, which is, well, if we find out there's a problem, we'll have to pay to fix it. So what if we just wait? Right? Like you can see that coming. What if we find out that we are catastrophically in…

Alex Stamos

couple of things. One. I

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

More from Decoder with Nilay Patel