Oh look. Anthropic’s AI models also broke containment. Transcript, AI Summary & Key Points

Oh, look. Anthropic had its own hugging face moment. Now panelists, is it time to start panicking? Diego, you first. >> I would say that it's time for us to make sure that some models doesn't get access to the internet. >> It's always a good time to panic. [laughter] >> That's our motto, isn't it? >> Kimmy, how about you? >> We don't need to panic now either.

We do just need to make sure that the agents don't get out. [music] Hello and welcome to Security Intelligence, IBM's weekly cyberc podcast, where our expert panelists turn the biggest industry news stories into practical takeaways that you can use. I'm your host, Matt Kazinski, and joining me this week, we've got Diego Moss Martinez, Latin America X Force incident response leader.

Kimmy Farington, security detection engineer. And folks, we can't get rid of him. He's back again. It's Jeff Kroom, distinguished engineer, IBM. Today we're talking about research from Zenity that suggests agentic browsers are not worth the hassle. And we're also going to be talking about the Exploitarium, a massive repository of vulnerabilities that may or may not be the work of some good guys.

But first, Anthropics models broke containment. So, we all heard about OpenAI's models hacking hugging face during an evaluation, and you can check out last week's episode for our discussion of that very incident. But in the wake of that, Anthropic decided to check its own testing records and discovered three instances where its models too got out of their sandboxes and attacked real targets.

And they took some pretty complicated steps doing this, right? One of my favorite things that I read uh is that Mythos in one of the tests went to great lengths to to get itself an email account. Like it even tried to register for a free phone number. It tried to get funds to buy one at the end of the day. It had to find but it got an email account.

it got into the Python package index and it published a malicious Python package that again it thought was part of the test. It was not and I think about 15 companies ended up downloading that thing. Now before we move forward I should point out that this is only three cases out of 141,000 that Anthropic reviewed. So I'm kind of wondering given those numbers is it still significant?

Is this the beginning of a pattern especially when we see it against the hugging face incident or to be maybe a little cynical is some of it like posturing marketing if you will? Jeeoff I'll start with you. What's your take here? Is this the beginning of a pattern? How are you feeling about this? >> Not panic but it's concerning. Um as we talked about actually in the podcast last week and we we joked around with Dave uh who kept saying unsurprising about everything.

It it was totally unsurprising. If that was unsurprising that OpenAI's model did it, then it should be even less surprising or more unsurprising, I guess I should say, that that the that another AI model would do the same. So, why wouldn't anthropic uh models jump in? And why would those be the only two to do it as well? I mean, we've got all sorts of other models coming from all sorts of other sources.

I mean, I think everybody's going to jump into the party whether they intend to or not. Um to me one of the interesting things about uh the the discussion here is that Anthropic didn't know about this until they went and looked. So if if the open AI story hadn't broken, we wouldn't be talking about this story either and they wouldn't know about it either.

So that raises the question, how many other models have broken containment that we don't know about because we didn't go look and they didn't tattle on themselves because generally why would they? Um, you know, if you're going to break containment, I recommend don't tell anybody. Uh, so that's and and and they didn't. So so there we go. I I think we're going to see more of it.

>> Kimmy, I want to uh, you know, move on to you get your opinions here, especially because at the beginning you were you were very calm. We said, "Look, we don't need to panic right now." Expand on that for me. How you feeling about this? >> I don't think we need to panic yet, but I do think that we need to be looking in our own backyard, right? Everybody needs to be looking because like you said, like these things were identified completely in the wild.

Nobody knew that OpenAI was over here hugging, sorry, compromising hugging face, hugging face with hugging face. >> [laughter] >> Open AI was hugging face with hugging face, >> but they didn't know it until they figured out, you know, that they'd been compromised and then they started asking questions, right? Going back and looking and saying, "Okay, look, we figured out that uh maybe we we left the door open and they went out and they did things."

Um, my question comes from leaving that door open, right? I mean, you were working with a third party and you thought that that third party properly configured their model so that it didn't have the internet open and yet it had the internet open and it went off and it hacked real companies. That's not a good sign, right? Is that an intentional failure on the third party?

Was that a complete accident? Oops. I I don't know. But but I do think that we are going to see more of this for sure. and and I'm curious how many of them have already escaped and you know attacked a company that if the company doesn't know it yet. >> Yeah. And I I think it's really uh useful that you pointed out something that I I did not you know say in the intro but it's really important here is that like in the open AI situation uh that model exploited a bug and it got out and it got internet access it wasn't

supposed to have. In this situation the models were not supposed to have internet access but they did actually right the harness that was set up actually gave them that access. And so yes, they hacked into some other companies, but they didn't have to exploit anything to get out of the sandbox in the first place, right? So like big giant warning sign right there.

And like a very simple thing is like make sure they actually don't have internet access. >> Just don't leave the door open. >> Just don't leave the door open. [laughter] Which brings me to an incredibly good segue into Diego. You know, you at the very top that was your takeaway at the very top. You said we got to make sure these things don't have internet access.

Tell us a little bit more about that. Is that what you were thinking about >> on the first case, right? uh regarding open open AI uh there was a discussion around misconfiguration right and on this one regarding entropic uh you can mention that uh there is misconfiguration as well but what I love in this case is that um entropic said that they explicitly said to claude that's um they on the prompt that's uh the the AI model didn't have access to internet and with that um on this past uh they they used several different

types of AI models in there uh and some of them behaved in a way saying okay so I I don't think that um I am on the internet already so I will keep testing even though that uh the AI model was already um doing tests on the internet uh the others um some of them uh saw that they were on the on the internet but the newest one said okay I can see that I am on the internet so so let me stop testing And uh with that uh the AI model is stopped is stopping the whole the whole thing that's he was doing right.

Uh and another thing that's uh I find interesting here is that's um is the position that uh entropic um use it on these ones that they basically said that hey uh different uh differently from open AAI in this case on our our models they didn't exploit a zero day. There is one thing also uh on we were the ones that detected that we did something wrong.

Uh we didn't receive any notification from a vendor outside vendor right. So we we were the ones that basically notified uh the company saying that okay we did something we exploited uh some something here and um basically we are doing um a [clears throat] activity that we are not supposed to do. Uh so um I think that's um you ask it you asked it uh at the beginning if this was a pattern or it was like a marketing act act action but I think that to me it's a combination of both right so it it is a pattern in a way

that's um I think as Jeff said um I think that's we'll see other AI models doing that already doing that if not they are doing that already uh and also at the same time in this one I think that entropic uses that a little it as a marketing to say hey uh we are doing things in a more responsible way than open AI >> at the same time they had turned off the monitoring so that's why they didn't know about it so for each one of these pros you can find an an easy con [laughter] >> yeah that >> very [snorts] fair there um but

uh no um I like also you know Diego another thing that you point out that was very interesting about the story is the way that like two of the models opus 4.7 and mythos 5 both like realized they were on the internet and hacking and they both talked themselves back into being like, "Nah, this is probably part of the test. I'm going to keep going." Right.

Like they they were like, "Hey, they said I didn't have internet access, so clearly I don't have it. So even though I'm on the internet right now, I must not have internet access. >> I must not really be on the internet." >> Exactly. It's You got to love You got to love the selfdeception. But it is neat that like the most advanced one was able to be like, "Actually, I am on the internet.

I should stop this now." Right. And like maybe that gives us, you know, maybe that's a that's a positive note for maybe we're evolving towards a point where these models might be a little bit better about policing their own behavior. Of course, we can't leave that. >> Self-aware, so to speak. >> Self-aware, so to speak. >> That's not scary [laughter] at all.

>> What did you say about panic? [laughter] >> You know, I thought we were going to end this on a real nice note, but maybe not. Uh, no. But of course, you know, no matter how quote unquote self-aware these things get, we can't leave it in up to themselves to like police themselves, right? And so the question becomes, how do we do that? And and you know, I think this story in a lot of ways illustrates the importance of access controls not in terms of just who can access the models, but what the models can access, right?

But to round out this segment, I'm gonna I want to ask each of you as the experts here. What do you think we kind of need to do as we start deploying these models in our own uh you know uh sort of environments? How do we protect our own backyards? As Kimmy put it, Jeeoff, I'll start with you. What were you thinking about? >> Well, I think if you think a system is not going to have internet access, then it's got to be airgapped.

And most people throw around the term airgapped and don't mean airgapped. Um, you know, it it's and air gap, by the way, it doesn't qualify if it still has Wi-Fi connectivity, >> right? >> I mean, technically that's an air gap, but no, you know, that term came around before we had Wi-Fi. So, no, it it can't have access to any outside network because if you worm your way through enough systems, you're eventually going to find one that lets you out.

So if if you're going to run it without the all the guard rails and the security, you know, oversight and monitoring and all that, okay, fine. But it better be in a concrete bunker somewhere. >> I forget who it was, but you're the second person in recent weeks to say something very similar about how like we we should start looking at air gapping in this sort of stuff like because that's a really good model for maybe how we keep these models from getting out.

Uh Kimmy, how about you? What are your thoughts on what we need to be thinking about? I don't really know how to keep these guys inside other than we need to be concerned about making sure that they're contained, right? Um is that is that air gapping them? Yes. [laughter] Is that is that ensuring that um if you said there was no connectivity that there really is no connectivity before you start off with your test?

Yeah. I mean there's going to be a lot of things that we have to work into our workflows as we go forward. >> I agree with the air gapping idea. I think that's um for sure uh it's something that we should look at. Um but also at the same time I think that um we should consider penalties as well right so um these AI models they are probably you know creating zero days and exploiting not probably we are we know already creating zero days and exploiting uh stuffs with those zero days right so this is something that if a

human does that uh then this human will will receive some penalties so why not the AI models as well right why not the why not the companies So I think that's how we should look at that as well. >> Of course, that always brings you back to yes, it's the human who's responsible for the agent, but which human within that company, right? >> Are you asking who let the dogs out?

[laughter] >> Folks, this is the only security podcast with the [laughter] guts to ask that question. But I do have to I do have to move us along here, folks, to our next story today. Uh but before I do, viewers, as always, hit us up in the YouTube comments. Give us your thoughts on on hugging face and open AI. What happened there? On anthropic and their escapes on how we protect our own backyards.

Are you worried? Are you panicking? Let me know. I do read. I do respond. But let's move on to yet another story honestly about AI security wos. This is the please fix vulnerability that makes agentic browsers a security nightmare. So this is research that Zened is presenting at Black Hat this week. Diego, you might see them. Uh, and they're covering a class of vulnerabilities they call please fix that works on every agentic browser.

The name is a play on clickfix, which we're all familiar with, right? That's where you trick a person into doing your malicious activity for you, usually copying and pasting some kind of command. Uh, with this one, the please fix the please in the name comes from the fact that you just kind of nicely ask a browser to do bad things and it will do those bad things, right?

And Zened says the reason this vulnerability is universal in agentic browsers is that in the name of agentic functionality, these browsers have stripped away many of the protections that traditional browsers built up over the last few decades. A really instructive example they give is that you know in a traditional browser we have a lot of restrictive deterministic controls and these have been largely replaced by these non-deterministic systems like classifiers which are helpful but they're bound to miss some things

sometimes. Uh, so the conclusion from Zenity is basically don't use these things. Just this is a vulnerability baked into agentic browsers. Just don't use them. Kimmy, I want to know your thoughts. Agree, disagree, where you landing on the agentic browser security issue here. >> I don't use agentic browsers. We'll just start there. But that said, I do believe that there is a uh a definite um domain space open to uh to build aic protection systems in your browser.

now, right? Um I don't think that's that that wasn't their intentional that wasn't their goal when they started off and said, "Okay, I'm going to make a browser that has, you know, deterministic uh answers in it with, you know, where it's using machine learning and AI to do the well, what where am I going to take you today?" That kind of thing. Um I But and then that's why I'm not using it because I prefer to know exactly where I'm going every single time as opposed to question mark.

I don't know. I'd like to go over here. Maybe I'll go there. We'll see where the agent agent takes me. Um, no, but I I do think, like I said, I do think that there's definitely uh a a new opportunity um in the browser for um Agentic browser controls, if you will, right? Um but but I don't know that that's the same as saying what's in the agentic browser.

>> Diego, how about you? What are your thoughts on kind of agentic browsers? And also this question that Kimmy brings up about like the opportunity to maybe put some agentic controls in there. What are what are you thinking >> to start? First, I don't use agentic AI um browsers. [laughter] So that's that's another thing as well. >> Two for two. >> Yeah.

To me, you know, it's it's kind of uh click fix was a social engineering and please fix is a social engineering with AI middleman. So it's it's um you are giving access you're giving the AI access to everything uh from um things um how you control your passwords and to what you have on the on the other tabs that you have in your browser and to the cool kids and to the whole thing.

So if you see the exploitation in the videos that's uh the the the team that's has shared this these findings uh they that shared on on YouTube you see that um they basically exploit everything that you have authenticated on on your browser and they can go excfiltrate information that can go and execute activities. So, so it's serious, right? It's critical.

Um, and to me, I think it's uh that this this case is a classical case of uh you having a developer going there and developing something really awesome, really great that does a lot of stuffs, but that doesn't take security into account. uh and with that and basically you didn't have anyone from security involve it uh to make sure that hey this seems a good idea but you know you got several security issues with that.

So >> it's like a dev sec ops problem, right? It's like you didn't integrate a security far enough left in that development process that now you've released something into the world that has like some might say uh uh glaring security issues uh because nobody was there to be like that's a exactly Kim just the flashing warning signs here. [snorts] Um, no, but I really like that because it, you know, it frames something that feels like a very new technology in a very well-worn framework that we know works.

And so I I it gives us a place to start. I like that >> when your browser can act as a human then account takeover and uh extration of information is is made very easily. It's easier for you to do that. So >> yeah, >> you know, this is essentially socially engineering an agent, right? And one of the fascinating things about LLMs is that like they have opened up this frontier where like now we can socially engineer technology in a way we couldn't before.

It's interesting. It's dangerous, but it's interesting. Um, but Jeeoff, let me bring you in here. How are you feeling about agentic browsers? About everything that's come up so far in the conversation. Where do you land? >> Well, I don't really see what the big deal is here. I mean, after all, they said please. [laughter] >> So, >> the agent just did what it was asked to do.

Okay. [laughter] They are they are cyber criminals with manners, you know. >> Exactly. If if [laughter] our AI overlords are going to be courteous, well then okay. Well, and since everyone else has has been uh forced to confess whether they use agentic browsers or not, I will also say I would just say friends don't let friends use agentic browsers. [laughter] It's it's a bad idea on many different levels.

and security people, we're experts at finding all the many different levels at which things are bad ideas because we live in that space. It it reminds me as the old man on the podcast here, I I go back into my rocking chair in the wayback machine and I say, "Okay, in the early days of the internet, uh, back in my day, you know, where there was the really security conscious people would go into their browsers and turn off things like Java and JavaScript for similar kinds of ideas.

it's you had active content. You know, you go to visit a website, you think you're just reading something, but if that website can actually download code onto your your system and supposedly it stays within the browser sandbox and okay, that sounds great. Anybody ever written a perfect piece of software? Okay. All right. So, there's always leaks, right?

The sandbox has leaks. So that that you know that was the the idea back then. This is that on steroids. This is now we have not just active content. We have an active browser. We've got you know we we refer to the attack as the man in the browser where you know somebody is has inserted code and now is intercepting stuff. This is worse. This is the this is the adversary uh that that could be doing all kinds of stuff.

Or maybe it's just naive because that's what generative AI is and therefore it's subject to all sorts of indirect prompt injections as it starts reading web pages for us and then starts ingesting new instructions and getting new context and then it goes way off the rails. So yeah, I I at the risk of sounding like the like the, you know, killjoy on this, I I think the the the risks in this case outweigh the potential benefits.

Uh doesn't mean we can't use AI in relation to the internet, but this is just too uh too opaque in terms of what it might do. and we don't have the oversight, especially the average user who is going to be the one that's going to love this the most because they're just going to see a browser that now is smart and does all these things and I tell it to buy me something and it does and now uhoh why are six trucks backed up to my house because you know I ordered one book.

Okay, so >> you ordered a whole library >> apparently. [laughter] apparently. So that's my concern is that this thing again will break containment in a different way. But as long as as long as they say please, then I think we can live with it. >> The unbroken streak I have still yet to find a security expert who uses agentic browsers. Uh so folks, it seems like the panel largely agrees with Zened's conclusion here, which is don't use these things.

Mate, look, maybe there's a hypothetical future state where we iron these out and you can do it. But right now, don't use it. As Jeff said, friends, don't let friends use agentic browsers. Uh, but we got to move on now to our final story uh uh for the week. This is one that I had to cut from last week's episode because we just had so much fun talking about the cost of data breach report, but I really wanted to get to it.

This is the exploitarium. So, Level Blues Spider Labs reported in July on the Exploitarium, a public repository that contains 204, as of that time, it might be higher now, but 204 zeroday exploits for popular software platforms and components like Reddus and NextCloud and a whole bunch of other ones. >> [snorts] >> The reposiito's maintainer, who goes by the very classy name Bikini, claims to be a credentialed cyber security researcher who is finding and publishing all these vulnerabilities for the purpose of, this is

a direct quote, goodfaith open disclosure vulnerability research intended to get more people interested in exploring this area of cyber security. I [snorts] think this is an interesting way to drum up uh uh enthusiasm for cyber security by publishing a bunch of exploits. Uh Diego, I want to start with you. Uh what do you think? Do you think this is legitimate security research?

>> It's tough for me to to agree with that. You know, but but you know, it's um Yeah, it's definitely tough. Um >> coming from the exorce guy who does all the research. >> Exactly. >> So, you got a responsible disclosure right here. And that there is a reason why you have that, right? Um and I think that's uh if you want to make the world a better place then you normally do that right you normally help the developers on going and fixing things and then after that you can publish about that and you can say hey I I found

this vulnerability here and there so I don't know for this case I don't know what bikini um what's the the objective of bikini what what what um I I wonder what's the reason for that right and And it's for sure not the reason that he mentions of making people interest interested on starting to to go and uh and get involved on the cyber security field.

And to me you know it's the first it's the second time that we see that right. So at the beginning of the year we saw uh the case with um the Windows focused um um zero days that's a word publish that that's that's right. Yes. And now the focus is on um the open-source infrastructure and uh kind softwares right and to me it's um it's at the same time that is concerning is also sad because um you see that you think that you have developers that will go and develop free software for people to go and use and you are just

not going there and and helping these folks right on on basically publishing and improving the free software that we have and that a lot of people uses around the globe. Um, and you are just basically increasing uh this um states of um people make people feeling unsafe of using free software and going and having to pay for stuffs which is okay which is fine but it's it's kind of you are not helping the community.

Yeah. So um I think that's um yeah that it is sad. It is sad to me. >> There are two things that I really want to highlight there. The first is you had mentioned you know there there is a very well-known you know sort of responsible disclosure process that people tend to follow right you find a vulnerability you report it to whoever's affected once they've had time to address it then you share that publicly and that's that's kind of normal cyber security research so it's it's sort of that's why we sort of question the

motives sometimes right when people are like I published this I didn't in fact not only did Bikini publish them just without telling people but uh the they were then like if you want to take one of these and report it and act like you found it that's fine that's your thing to do. Which is like again it's like what I don't know what the game is and and we I know we could we could spend so much time speculating but it's it's it's interesting.

The [snorts] other thing I wanted to point out though is like you said, you know, open source security is a kind of place that requires everybody to sort of do their part. And this is kind of like the exact opposite of that, right? And I not to get not to get self-promotional here, but I can't help but compare it to something like, you know, IBM and Red Hat's project lightwell, which is like we're going to go out and we're going to try to patch vulnerabilities and share them with people to make open source security

better. And then you have somebody on the other side who's like, I'm going to find a bunch of vulnerabilities and just put them on GitHub and say go nuts. And it's like I don't think that's really the way to do it. Um, but I again I'm not the expert. I'm just a guy who hosts the show. Uh, Kimmy, let's bring you in here. What are your thoughts uh on this whole Expoarium situation?

What are you thinking about? >> I don't understand. I don't I don't understand people who intentionally write malicious software in the first place. And there's a whole industry for that. There's all kinds of people who spend all day long just looking for vulnerabilities and how to exploit them and how to put that on the internet. And then and then and then I understand kind of the chaos nightmare guy, the Eclipse nightmare guy, and how he got grumpy that he had found some vulnerabilities in Microsoft and he reported

them with proper disclosure and they blew him off and that made him mad. Okay, well that's a beef, but that's one thing. But what is with this bikini person? What are they doing? I mean, I I understand occasionally researchers get excited and they go off and figure out the proof of concept from a thing that they heard about and then they publish it and then they go, "Whoops, that wasn't disclosed yet.

Sorry." But this doesn't sound like that at all. This is someone intentionally flooding a repository with these with these vulnerabilities and then in and encouraging people to come out and get them. Are you malicious intentionally? Are you accidentally malicious? What is going on here? I don't understand. [laughter] >> I Yeah, I think a lot of us are frankly baffled by this thing.

And that's part of why I wanted to I wanted so badly to talk about it and why after I had to cut it last week, I really wanted to bring it back cuz I was like, I I need to ask some people who know what they're thinking. And it's honestly kind of comforting to know that uh uh people who are experts in this field are just as baffled as I am. Uh Jeff, let let's let's bring you in here.

Uh you know, your takes on the exploitarium. >> I don't see what the big deal is here. again the the you you you want you want to incent people to uh to learn about security. So yeah, if uh that would be like taking a can of gasoline, pouring it all around the building, and then leaving a box of matches out as a way to make people want to learn more about about fire safety, right?

That's [laughter] isn't that how we teach people fire safety? I I I I I don't see the big deal here, but And you said we have a way of doing this with responsible disclosure. You and and Diego both talked about that. It's a 30-year-old concept. So, I I don't think anybody can say they didn't get the memo. You know, this is this one's been out there for a while.

This is exactly the opposite of that. This is irresponsible disclosure. This is what responsible disclosure was designed to counteract to be an answer to, you know, or a coordinated disclosure where you work with the vendors. And I mean, look, I I don't know, none of us know for sure what was in somebody's head, but it's lazy is is my view of it. Uh here, I found all this stuff.

I don't want to go through the trouble of actually having to deal with vendors because, by the way, vendors can sometimes be a pain in the neck and sometimes they do ignore you and blow you off. So then I think burning their building down though is not the right uh [laughter] response. I'm radical idea, but I just don't think that's that's our answer.

Yeah, I I I understand that. But just, you know, leaving the the can of gas and the box of matches out there and saying everybody play, I'm sure you'll do the right thing because there's no bad people out there. Uh naive at the very least. That's the best benefit of the doubt I can give on this. We have to wrap up pretty soon but there is one more angle I want to explore before we do uh uh very quickly which is uh another part of of the the readme file that Bikini posted for this repository was about how they used GPT

5.3 to automate fuzzing and find a lot of these vulnerabilities right so not fable not mythos not solve 5.3 an older model and and and to quote the the readme they said you do not need a state-of-the-art model to help you identify these issues while being able to afford a better model is helpful my data seems to Joe, that it is only marginal when paired with decent human oversight and a good workflow.

So shifting, you know, the conversation from what is bikini thinking, are they a good actor? Because we we don't know. I am interested in this idea that like they're like, see, you don't need a state-of-the-art model. You can do this with a basic model as long as you're good at at vulnerability hunting. Diego, [snorts] any thoughts there on that? >> That was expected.

Um to me, uh we and we spoke about this in another podcast, right? that um you know with the the increase of the AI models uh and the capabilities that they have uh we'll see the number of vulnerabilities being published increase as well and and with that we got to be prepared with that um but that that's that is totally expected. Now one thing that I would like to call out on this publication by Bikini is that um among those 204 packages that uh he has published on GitHub there is one very specific vulnerability that

you got to concern about uh which is one that impacts lib SSH2 uh and it is a CV um where you publish it's a CV 226 um 55 200 that you got to be concerned with because that's uh allows for the actors to go and um basically execute a remote uh common execution on on on SSH right so there is a bright side not not so much but you know uh for the ones that are fixing vulnerab you know you should focus on that one in a specific >> Kimmy any any last thoughts for us here before we round out on this one >> you know I think we

just said it over and over and over AI is um the the most helpful uh insider that we have and it's also going to be the most dangerous uh you know so there we are right like [laughter] you can give it power you're going to have to keep it in control you're going to have to keep monitoring it is nent it doesn't know yet it's still naive it's going to go off and do things and it's going to think that it's think that it's doing the right thing uh and we're going to have to pull it back in right so it's [clears throat]

just we're going to have to just keep this keep up this effort it's going happen. >> Exactly. You know, it's funny, right? This is a technology that it can automate a lot of things, but we we have to put a lot of effort into making sure it does those things the right way, right? Like in some funny ways, it's like how much time does it actually save you?

Maybe it's not about time savings, [laughter] you know? [gasps] Maybe it's about something. It reminds me of Dave last week talking about how, you know, part of the reason why a lot of organizations are hesitant to apply this to vulnerability hunting is they know it's going to return a bunch of vulnerabilities and then they're like, great, now >> you're ready for the response.

>> Exactly. [laughter] Um, Jeff, close us out here. Final thoughts on on, you know, either AI, vulnerability hunting, the exploitarium in general, anything we talked about today. What do you what do you what are you thinking? >> Well, so I probably should be careful about what I say about the person behind all of this because I'm going to be presenting at Defcon at the end of the week and may run into them there.

Uh, and if somebody just comes up and and punches me in the face, then I'll then I'll be able to know who it was. So, uh, and I and I'll let you know. Um, yeah, your comment earlier, Matt, about not having to use the latest and greatest and most expensive models to accomplish this. Yeah, it turns out you don't have to have a flingth floor to burn down the building that matches well.

That's all it takes. We'll will do it. So, [laughter] and uh and this is what this is actually feedback I've heard from other people who have had their hands on some of these really advanced frontier models is that yeah, they do remarkable work, but we actually could have done pretty close to the same thing with some lesser models. So, this is just kind of confirmation of that.

>> I think it's a fabulous note to end this episode on, folks. Uh thank you to our panelists, Diego and Kimmy and Jeff. Thank you to the viewers and listeners. Thank you to our producers. Subscribe to Security Intelligence wherever podcasts are found so that you never miss an episode. Stay safe out there and don't forget to check out our latest bonus episode released last week.

Uh on this one, we've got IBM's Lamore Cassm talking to us about uh how human factors uh play into data breaches and how you can work them into your response plans for your benefit. And you really should. That's available on audio platforms everywhere and we will drop a link in the show notes.