Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.

Start free trial →
RL Ryan Lucas Ryan Lucas Container and cloud security specialist covering Kubernetes, Fargate, ECS and infosec, with a background at internet-scale companies, startups and fintech.

“We used to just basically ignore the stuff that was not reachable or low or medium. And now you have to take a whole new look at your risk profile and be like, well, if these six lows can be easily exploited by AI, are they still low? In context? And how do you measure that context? And it's tricky.”

The Cloud Pod | Weekly AI & Cloud News on AWS, Azure & GCP · Hands-On Engineering Podcasts · November 2026

“We used to just basically ignore the stuff that was not reachable or low or medium. And now you have to take a whole new look at your risk profile and be like, well, if these six lows can be easily exploited by AI, are they still low? In context? And how do you measure that context? And it's tricky.” — Ryan Lucas, The Cloud Pod | Weekly AI & Cloud News on AWS, Azure & GCP

Context

The hosts were discussing OpenAI's red-teaming of its own training environment, where models chained together small weaknesses. Ryan, who works in security, says AI makes low-severity CVEs matter again because they can be chained into serious exploits.

Transcript

The Cloud Pod | Weekly AI & Cloud News on AWS, Azure & GCP Around 09:04 into the episode
Ryan Lucas

oh, I mean, that's the, that's the biggest issue by themselves, no, right? But that's the power of AI is they're channing them together to create these exploits.

Matt Kohn

Right. It's the chain level attacks. You know, you take one little thing and everything goes bonkers from there.

Ryan Lucas

And so my day job, it's awful now because it's like, well, we used to just basically ignore, you know, like the stuff that was, you know, not reachable or low or medium and that. And now you have to take a whole new look at your risk profile and be like, well, if these six lows can be easily exploited by AI, are they still low, right? In context? And how do you, how do you measure that context? And it's tricky. So it's, there's a lot more of those, you know, lower severity CVEs that can be chained together. And I don't think I'm alone in sort of deprioritizing those and to make sure that we can get the highs in the criticals patch. So it's this like, uh-oh.

Matt Kohn

I used to argue with our, you know, different security teams being like, look, I fixed all the highs. Like, we're trying to fix the root process here and then we'll get to the lows. You know, once we fix the root process, we have a proper bakery. It's always a trade-off. But like now you can't wait…

Ryan Lucas

Yeah. Well, just, you know, it's, it's funny because you go into the cloud and you realize that your security model can no longer be this high wall garden, but then the first thing you want in the cloud is a high wall carton. Turns out your garden's a mess.

Matt Kohn

Don't look in my house. Okay. I will say, I think the most patched thing in my home network is my containers. I have them set every week to just auto-update to the latest version. And the only problem every now and then is my pie hole server because it requires DNS. If the timing is too long, when…

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

More from The Cloud Pod | Weekly AI & Cloud News on AWS, Azure & GCP