“I didn't think that we could have found it without AI. So the opportunity for a team of 10 of the most talented people that I know… if we had taken all of them and told them, hey, maybe find some PHP RCE bugs, maybe it would have taken them a couple of months of work, maybe even 12 months of work… why wouldn't you try 20 different ideas on various different targets and just run them on top of Atlas… and maybe do it over the weekend?… Right now we can, you know, 100x, 1000x the work of a researcher.”
Equity · Startups & Venture · October 2026
Context
Wiz's CTO on how his team found critical bugs in PHP using an in-house harness built on frontier models. The host had cited a view that such finds are still 90% human work; Schwartz half agrees, but says the scale of what AI lets researchers try is the real change.
Transcript
…ones and work on them. At the same time, I do know a little bit from our work with OpenAI and Calif. They're doing very similar things and trying to use their own models and new ideas to scale up research with AI. And they're finding in many cases very similar bugs to the bugs that we're seeing.
…supercharged, right? Like Calif found the bugs in a security audit. Says, this is from our security editor, Zach. He said that AI helped with the exploitation, but there was 90% human work. And Calif's own line on this was that no model is simply capable of unearthing all bugs, at least for now.
…I sort of agree. There's still an art and a science to this in how do you direct all of these models and how do you actually tailor them together to be able to find such impactful bugs. But in reality, I didn't think that we could have found it without AI. So the opportunity for a team of 10 of the most talented people that I know that are powering the Wiz vulnerability research team right now, if we had taken all of them and told them, hey, maybe find some PHP RCE bugs, maybe it would have taken them a couple of months of work, maybe even 12 months of work. And eventually, who knows? Maybe they would have found the same finding. But what's cool about this is that we managed to take all of those people and tell them, hey, why wouldn't you try 20 different ideas on various different targets and just run them on top of Atlas and find a ton of different potential vulnerabilities and maybe do it over the weekend? And by the time we come back next week…
Yeah, I mean, it's great for defenders. It's also great for attackers, right? And that's why we saw such a push to get this bug fixed because attackers are using AI to send out mass attacks and to 100x their own capabilities. Can you tell me a little bit more about Atlas? So Atlas is your harness.…
But we constantly change it, right? I mean, with the pace in which AI models get better and better, we got to update this all the time. And there's also various different steps where we find that certain models are better at as opposed to others.
Can you give me an example?
More from Equity
