AI skills security, Open AI Deployment Company & zero days Transcript, AI Summary & Key Points

00:01 So, is it going to replace jobs? Um, I think it's going to change jobs, right? And I think it's going to make consulting, for example, able to solve problems that they otherwise would not have been able to. But I don't think it's going to be the traditional consulting that you see today. All that and more on today's Mixture of Experts. I'm Tim Hong and welcome to Mixture of Experts.

00:25 Each week, Moe brings together a group of brilliant minds working at the very cutting edge to debate, discuss, and guide you through the week's news in artificial intelligence. On this week's episode, we've got Kush Varsny, IBM fellow, Aaron Botman, IBM fellow and master inventor, and we're going to be joined in just a bit by Dustin Haywood aka Evilmog, who is the X-Force executive managing hacker and senior technical staff member.

00:46 After the panel, we'll also have a special segment with Brianna Frank, vice president of product and design cloud platform. We've got three big stories that we're going to talk about in a panel today. We're going to talk a little bit about OpenAI launching a new thing called the deployment company. We're going to talk about Google's uh disclosure of some very interesting zero days uh driven by AI.

01:10 Kush actually because you're on the show, we actually want to focus first on some research which we haven't done in a while. Um and I actually want to get our show back to like talking about papers. Um and it's a really interesting paper called Malia which focuses on a problem that we've talked about ate um from time to time which is that you know in the open claw era and in the agent era uh skills are really the building block of how these kind of agents operate and needless to say the skills ecosystem is is is pretty

01:35 scary right now. Kush I don't know if you want to kind of intro the paper and you know sort of like what you guys are trying to solve but it feels like a big part of it is dealing with that security issue and skills. Yeah. No, that's exactly right. And um yeah, so Melia is this um thing uh this effort at IBM research. Um it's uh trying to uh take these ideas of generative computing forward.

01:56 So um computing itself, I mean there's lots of ways you can do computing where uh I've maybe talked a little bit in the past about quantum computing. um classical computing is what everyone is familiar with and generative computing is thinking about uh what is AI bringing forward um with these LLMs and everything else. Um as just another additional component to whatever else is still in computing um so that includes all the other stuff that helps us be safe, secure, efficient, abstracted and and all sorts of things

02:28 like that. So um a lot of my colleagues um at IBM research have been working on um this u paradigm called Melia. Um so it's uh basically the idea that um if you are going to have um something to do like a program right um can you write it with regular code first of all um do most of the things deterministically and then only when you need to um call a generative uh slot.

02:56 So um kind of call an LLM in in those little places and uh what are um regular code good for is like uh control flow I mean all sorts of different things and then uh use the generative thing just where it's good for which is dealing with context and um uh composing things and and so forth. So uh the new idea that we were um we've been working on recently is um uh actually inspired by my appearances on the show.

03:25 Right. So, um the stuff we've talked about um uh was part of the thinking that went into it and um it's that uh like you said with Open Claw with um all sorts of other um sort of agents out there. The skills marketplaces are um full of all sorts of um weirdness, badness, I mean things like that. So um how can you kind of process those skills um to make them more reliable, safer, more efficient and um with less contradictions and and so forth.

03:56 So what we've been working out is a methodology and a pipeline for taking a skills.mmd file um and processing it um we're calling mlliaing it um so making it uh into a structured program a python program um and uh really just again calling this like small lms when you need them uh in that program and then the program is the skill um and then you can run it uh using addition um uh I mean different harnesses.

04:27 You can just call the Python program from the command line if you want, but um and and so forth. And then we do a bunch of safety checks, security checks. We add these extra guardian sort of hooks into the program itself in order to to make sure that when it's being run, it's um also being being safeguarded. So So that's kind of the the idea, and I'm pretty excited about it.

04:50 I think it can be be pretty valuable to bring some order to this uh the claw havoc that that we're in. So >> yeah, the the the crazy situation we're in. >> I mean Chris, I think what's so fascinating is you're not saying it in so many words, but it's almost like the future of skills >> might be programs. >> Uh like you're almost kind of going in the reverse direction where you know I think like the dream was oh hey skills they're going to be this kind of very open-ended you know almost like narrative document and

05:15 almost you're saying is like in order to ensure security we have to make them deterministic again. Is that right? >> Yeah. The narrative is good for a lot of things, right? It's it makes life easier for the people putting them together. Um but then like we think of this as a compiler. So um we call it the Melia skills compiler. And um just like in any other compiler I mean you make things easier for the programmer for the person putting the uh the thing together but then uh in the back end you compile it into something

05:48 that's hardened that's more robust more efficient and and so forth. So we don't want to lose out on the fact that for authoring um natural language is a is a good medium but then for enterprise deployment you do want to compile things into something more solid and that is a program and specifically a Melia program. Aaron, maybe I can bring you into this discussion.

06:07 I mean, when you've been on the show, you've talked a lot about how you all are using kind of agents in the field and, you know, teaming up with folks like the Masters and, you know, kind of the US Open. Um, how do you in your practice right now deal with the uncertainty around skills? Uh, like just to give our listeners a sense of like how it happens today?

06:22 Um, even in your own projects, are you are you manually reviewing skills? Do you not use skills at all because of the security issue? Um I'm just sort of interested in kind of how we translate what's happening in Malia here to like sort of the problems that people are having on the ground. Yeah, I think this is a really very powerful and a great idea, right?

06:39 Where the industry is moving towards these prompts as code, you know, because it creates these these agent skills that can be reused, right? It creates type prompts, um, compiler validation. Um, you can port these agent behaviors across to a different other agents and create these digital workers, right? And they're very declarative, right, on the orchestration layer.

06:59 and and whenever you know we're in the field and we're looking at creating you know these types right of areas um we do have agent cards right and in the card it describes you know the all the skills that it has um you could think of an agent as a node but it shows how all the nodes are connected together but each one of those particular um agents you know they have different prompts that tell it what to do right so so if our agent workflow or or our agentic system is following a particular flow, right?

07:33 Um it could be or a pattern. Um it could be like the critic patterns, you know, you know, so so for example, if we have one um agent that's creating content and then we have a judge agent that's judging on different dimensions on how it's doing, each each one of those agents has its own prompt. Uh but it does get very chaotic, right? Uh because the prompts change.

07:51 It's hard to version them. um it's it's hard to uh know to make sure that you know if we add in a certain instruction within the prompt um or a rule set does it help or hurt right uh but being able to compile this skill right and put it into a library you know such that it's already have a schema validation check uh we make sure that you know it's the tools that it's going to use is safe you know you know so for example we don't want to constantly hit an origins server at at a really high scale right we want to make

08:24 sure it's protected by a CDN for example, right? um you know um it it it makes it for for a very nice almost like a plugandplay you know piece right so um so I for one am very excited about it right um and and it also gives us more of a predictable multi-step behavior in a sense and and because you know our team is quite large right and and and other teams are too you know that create these prompts and it it it just makes it much more manageable right to to ensure that uh what we're doing is correct um and and it also

08:55 helps to protect against prompt injection or instruction hacking as well. You know, uh since it is as code and it's and it's already verifiable, right? You you have sort of this implicit trust so that you're not also doing this tool over permissioning um um aspect, right? So, uh this concept of a skill I think is great. Um and I'm looking forward to really using it more.

09:19 Um, one other point too is that we use A2A and I know uh, Melia, you know, it doesn't depend on ADA A2A, but it is compatible for it. So, it's very agnostic as protocols emerge. >> Well, Kush, where does this uh, work all go um, next? I mean, I think like is your is everything going to go back to being normal programs again or like what where where do we expand this kind of work?

09:40 >> Yeah. No, I think uh this idea of generative computing is um taking us forward in the sense of um uh I mean again like I was saying before like use everything we've learned over whatever 80 plus years of computer science and um kind of uh do things in the right way like um so like this is a compiler um you can have operating systems for generative um sort of tasks um and so forth you can have all sorts of things right and um So I think that's the the sequence is um go back to your computer engineering textbook and

10:14 see like what changes what stays the same and uh uh kind of use the the generative uh sort of module that we now have in in the best possible way. >> Yeah. Yeah. I wanted to mention too, you know, on the gen compute side, you know, we're we're looking at um having agents automatically autocreate prompts, right? and and the the autocreation of prompt, you know, if you can inject Malaya in, you know, to compile it, right, to do the validation of the prompt automatically, you know, in in this flow, um, I think that really

10:44 helps to increase the trust, uh, both from a security perspective, but also from you could think of it like an item potent, you know, aspect. Um, but, u making sure that the results, right, that are coming back and being pushed, you know, as a persona to another agent is really what you intend. So, it's uh, it's a nice building block, I think. Well, Chris, if folks want to play around with some of what you built, read the paper, where's the best place to find it?

11:08 >> Yeah. Um, they can go to melia.ai. Um, that'll introduce them to uh the uh the overall project and then, um, within the GitHub, there's the Malia skills compiler as well. >> Well, cool. We'll definitely have to have you back on here. I feel like the skills security question is just this enormous one. Um, and so, uh, more to come on this front. I'm going to move us on to the kind of second story that we were going to cover this week.

11:33 Um, a really interesting story. Uh, OpenAI has announced that they're going to be launching uh a new enterprise called the deployment company. Um, and what's so interesting about it is basically the deployment company is a it's a consult it's a consulting business. It's a it's a services business where they will work with large enterprises that want to integrate AI and um help them with that integration.

11:55 Um so this is really interesting to me at least um Aaron if you if you believe in the dreams of artificial super intelligence um you know all the consultants are doomed right you just plug the AI and it will solve all the problems but here of course one of the biggest arguably AGI super intelligence labs in the world is turning around and saying we're going to put a lot of money into services and integration uh as a way of ensuring that enterprises can get the full value out of the technology.

12:23 Um, so what's what's going on here? >> Yeah. I mean, so so I read the you know, read some papers, you know, I was doing some research and I was scratching my head at first. I was curious is, you know, how is open AI going to be able to focus on non-open AI models, right? Because if you're a pure consultancy, you know, place and you're trying to help enterprises, you know, generally the enterprises has to look at multiple foundation stacks, you know, all the way from um the intelligence layer down to the the

12:54 infrastructure layer, right? And each customer has their own uh piece, right? And so, so then then I was asking myself, what what is OpenAI going to focus in on? And so, you know, large companies today, you know, uh like a lot of what we do at IBM, you know, we help them focus on uh potentially foundation models, but we look across, you know, stacks.

13:15 We look at, you know, granite type models, but we also, you know, look at what's over on Bedrock, for example, and we mix the models um together that aren't necessarily our own, but we meet the customer where they need to be met um to help them produce, you know, a solution for their use case. um and they already have internal machine learning systems, existing cloud stacks.

13:36 They might even have specialized models that they have distilled. So, it's outside the realm of these open AI models. Um but it but I think what the likely operating model here is going to be is that open AI, you know, with with this new company that the primary intelligence layer that they're going to push of course is going to be open AI models, right?

13:56 but they're going to have supplementary tooling or they're going to need to, you know, to support things like Google Anthropic, open- source pieces. And then down on the infrastructure play, you know, they're going to also have to look at other pieces like AWS, Azure, Snowflake, and so on. Um, and and and I think this is supported because I was looking at some of the partners that they have signed up.

14:18 I mean, the I think they're at like a $10 billion valuation already, right? I mean, it's quite high. Uh but I but from from what I could find it looked like McKenzie, Capgeemini, you know, Bannon company, right, that that they're going to be partnering with OpenAI, which tends for me to think that they're going to be looking at the entire ecosystem, right, around this um AI uh piece, right?

14:41 Um but it but it's it's it's going to be neat, you know, and I don't think it's hype, right? Because enterprises gen genuinely they really need AI integration. I think that's where uh lots of this is. But part of it I think what is hype is that you know AI transformation right it's sort of being marketed right ahead of the operational reality at the moment look at the numbers that there's only about a third of companies are scaling AI across the enterprise right right which means that you know some of these points are

15:11 overhyped but there's a real need right to help the other twothirds of companies sort of get there and fill in the gap >> kush uh last week we were at think uh and the the episode that we did there ended up focusing a on sort of like that the technology is almost like 50% of the story, 10% of the story and how much just goes into like getting these enterprises to really get all the benefit is is this like enormous kind of change management problem.

15:36 Um uh I mean here's a weird hypothesis. Does it turn out the deployment company becomes like a really major business for open AI? And does that also introduce its own risks? Right? because I, you know, to Aaron to your point, right? Like OpenAI obviously has an interest in what model you use when an enterprise goes to use this stuff. So I'm kind of curious maybe the short question here is like how bullish you are on this strategy and whether or not becomes really a major part of OpenAI's business.

16:02 Um yeah, I think the strategy makes it such that uh RC Orvin is um like almost preanted right I mean he's been talking about how models are um getting commoditized and everything and um really the uh the integration part is um where the the business opportunity is. So uh given that open AI is um I mean launching this consulting business I was also reading I think Anthropic has some joint venture that they announced last week as well that is along the same lines right so the models aren't the business in in some sense

16:36 right I mean that's one of the points um it's the integration the consulting everything that goes along with it is the business and then to your point of the risk right I think um uh the way we're setting up I mean IBM consulting and everything IBM is setting up our sort of world view is um on this sovereign sovereignty sort of point that Aaron was talking about which is do what's meet the customer do what's best for them uh whatever model it happens to be um whatever is right for them right and uh like having this

17:06 like opinionated like strong opinion that uh we have to use these models is maybe not the right sort of answer for for most clients for uh for for businesses and so forth. Yeah, it almost kind of feels like we've like very quickly moved from the first question was, oh, is AI going to be a consumer business or an enterprise business? And lo and behold, maybe a month or two ago, we heard rumors that OpenAI was saying, okay, we're going to focus on enterprise like entropic.

17:32 And then now it kind of feels like almost like the competition is like moving again. It's like going from like, oh, we're going to be enterprise, but we're going to do enterprise consulting. That's actually where like the business is. Um, it'll be so interesting, I think, to see this um this competition evolve. Um Aaron, maybe like a final kind of cheeky question here is uh we talk a lot about like future of work on what's what's AI going to replace?

17:55 What's it not going to replace? Um you know is like does it turn out that like McKenzie or like you know or like consulting businesses as a whole is that the most AI robust profession to get into now? Uh like I I like it's kind of an interesting outcome but is maybe suggested by what what's happening here? Yeah, I mean it's really fascinating with what what what's happening, right?

18:15 Is, you know, I think what you're going to see is the merging of software and and consulting, right, where um you you'll see lots of different uh virtual workers that that have certain skills, right? Um and then they're going to learn domains and maybe they'll be badged, right? So, you know, you might have um on the tech side, you know, you might have a worker that's certified in Java or certified in Python, certified in Lisp.

18:39 Uh but then on the domain side, you also might have other domain virtual workers that are certified in let's say comms. They could be certified in finance. They could be a CPA even, right? Uh but but the but these searchs that used to be human are now going to be both human and virtual workers, right? And these virtual workers are composed of these agents that you know have these skills that are now verifiable and trackable, right?

19:05 And so, um, I think it's going to be a combination of you, you know, I'll just call it software, but software and humans now merged and working together, um, in an accelerated way to help solve some complex problems that we ordinarily would not have been able to do, right? So, so is it going to replace jobs? Um, I think it's going to change jobs, right?

19:27 And I think it's going to make, um, you know, consulting, for example, um, you know, able to solve problems that they otherwise would not have been able to. Um but but I don't think it's going to be the traditional consulting that you see today you know uh so next you know one year two years right uh you're going to see lots of these different um aspects show up um but it's uh but it's going to be fun you know as a techie um I'm pretty excited about it.

19:55 >> Yeah the coming battle I think is because I think what you're saying is that like there'll be lots of different models for doing consulting. So I think that's what we're about to see work out, right? Is like how much like the tech- enabled consulting will be beneficial, how much, you know, kind of this sort of like semi-vertical integration between the model provider and consulting will work out.

20:12 Um it'll it'll be a real kind of like free-for-all for a bit, which will be really interesting to watch. >> Mhm. Yeah. Yeah. Yeah. Yep. Yeah. And and I wonder as some of these forward deployed engineers, do you know that that OpenAI is pushing forward? Um it'd be it'd be neat to to do some research um and it could be out there already, but um are they equipped with these virtual agents or you know these these workers to to help them out, right?

20:32 Is this sort of like the beginning of the symbiotic relationship of you know AI and humans consulting together because 150 isn't a lot, right? So I mean that's that's just the start. So, so to me I wonder are they being forced, you know, amplified with these AI tools, you know, or or these super intelligence and that's what they're using and they're marketing that process, right?

20:54 Um, and they're and in effect using their own open AI models as their ver virtual workers, but yet they're able to work and meet the customer where they are in the models that they're using. All right, so let's get to talking about this super interesting uh zero day story coming out of Google this week. To kind of navigate this news, we've got Dustin Haywood joining us.

21:20 Dustin, welcome to the show. >> Hi, thanks for having me. >> Yeah, glad to have you here. Um, so uh I really wanted to kind of take a specific angle. So the story that came out this week, if you didn't see it, is uh Google disclosed that they had discovered a zero day. Not too surprising of a a discovery. Um, but the main thing that they kind of appended to this story was that they appear to have evidence that AI was used uh to both kind of discover and leverage the exploit.

21:45 Um, and um, and I think it was just such an interesting story particularly on the wake of all of the kind of um, anxiety that has been inspired around the Mythos uh, uh, announcement from Enthropic. And here the idea is that Mythos's next generation of model is sort of so performant particularly against cyber security that we have to avoid launching it and we need to make all these patches in fact before they launch it um to avoid the cyber security risk.

22:11 And so I guess Dustin maybe a quick question for you. I'm shaking like kind of scratching my head over here because I think on one hand you know it feels like good that Entropics being responsible about the launch. Uh on the other one it just seems like you know AI is already being used to identify all these exploits. Um, and so I guess kind of question is like is the game kind of already lost here?

22:31 Like are we already living in AI, you know, cyber security nightmare world? Um, and uh, and what should we make of this news from Google? >> So, I mean, honestly, we're already seeing this been ramping up. Um, the first talk of AI finding zero days was actually at the unprompted conference in San Francisco back in March. Um, Anthropic was using Opus 4.6 to go find these vulnerabilities.

22:51 Um, the real difference is Mythos is good at chaining together multiple steps in an exploit. But in terms of straw zero day, all you need is any open- source model or open weight model and go file by file. We're already seeing a number of things from copy fail, dirty frag, there was a um PHP vulnerability that just released. There's a number of these vulnerabilities coming out.

23:13 So much so that our X-Force Offensive Research team has coined this patch apocalypse because as these bugs are coming out, they're getting patched basically immediately. So some of these bugs have been around for, you know, 10 years or longer. It's just refining them now. That's all the real differences. But the step difference in Mythos, and this is why they're not releasing it.

23:33 I mean, OpenAI has their own version and everyone's all building their own agenic pieces is it can now chain together, you know, let's call it 10, 20, 30 steps together to go through say a long penetration test. But in terms of the actual zero days, the threats are already out there. So, it's just a matter of time. There was actually a a clock that was released and I can't find where the site is, but I saw it two months ago.

23:56 It was like the mythos countdown clock where they compared the openweight models at to and the commercial models to how fast they've caught up to methos. And at the time, this is again a month or two ago, they said 228 days until the models keep up. And this comes from the fact that we've got an exponential growth in AI capabilities. So >> Mhm. Okay.

24:16 All right. Well, that's that's very exciting inducing. Uh I was hoping that you'd say something that would be good news. Uh I suppose >> Well, there is good news. There is very good news. >> What is the good news? Yeah. >> So, the good news is AI is also really good at verifying the patches and finding these vulnerabilities so we can fix them before they were there.

24:32 Like these bugs were there for ages. It's just now they're being found. So, a problem name is a problem solved. So, we're now accelerating and fixing these bugs before they get into production or at least within, you know, a reasonable period of time afterwards rather than sitting there for nine months being undiscovered by people hoarding them. So, it's killing the exploit broker game a little bit.

24:55 >> Yeah, absolutely. Kush, do you want to talk a little bit about like where we land? Uh, you know, particularly with um Dustin's analysis here, it kind of feels like, you know, maybe we're just kind of at par, right? Like as kind of like T approaches the, you know, maybe not infinity, but like a midterm. Um, the kind of balance between offense and defense seems like it might kind of even out.

25:15 Do you buy that? >> Yeah. To me, I think that is exactly the point, right? I mean, to me, the story isn't really a story. It's like a whatever dog bites man sort of story rather than man bites dog in a way because um uh like I mean if the story was whatever like a 10th grader uses AI to do their homework or um one of the mixture of experts experts uses AI to help them prepare for the episode like that's not news right um so like I mean yes these AI tools are around and um people are using them um for bad or for good

25:50 and um I think the balance is there. I think um there's no like particular like uh like weight towards one side or the other and I think that's actually a good thing. So um yeah, we'll we'll see how it goes. Um of course I mean having more uh advantage to the defenders would have been good but uh I think we're we're kind of in in that equal sort of setting.

26:12 >> Yeah. And I guess that's I put some words in your mouth. I don't know if that's what you get. >> There's actually funny part is there's actually an advantage right now. So when attackers attack a network especially say a nation state or advanced adversary they used to go very very slowly. It took 9 months to get in and stay there. Nowadays all these new AI tools are operating at lightning speed which means they're very easy to detect.

26:31 So in that regard all these attacks are you know being slammed down extremely fast which leaves detection signatures. It's it's a bonus for all of us as defenders. And Chris just a moment ago was like, "Ah, this is in some ways kind of like a non-story." And I think Dustin, you've you've I think you opened by saying, "Look, we've known that like this can happen for a really long time."

26:52 Uh I don't know, like for this Google story and I guess subsequent story, should we kind of just eye roll now? Like it's kind of like, oh yeah, of course. Uh it's almost like saying you found a cyber security vulnerability by using a computer. Like of course you're using AI to do it now. Like this is just no longer a new thing. >> Yeah. I mean I mean a few thoughts come to mind, you know.

27:10 first you know what's happening in the field is that good enough matters more than the best right so if you have a good enough model that's available then sure you can come up and you know create some generative AI type code you know as as long as it works right um then you know it surely can you know help the offensive attack you know so that seesaw offense versus defense you know offense you know has you know the the advantage but um over time you know you know I it's it's beginning to flatten out where it's even you

27:39 know it it'll constantly go back and forth back and forth. That's just the nature of this elasticity between offense and defense, right? But I think, you know, the real debate isn't about should we release frontier models, right? Um you you know is is it really going to help you know um offense or defense. I think the real debate is what are the policy trade-offs that must be made in order to accelerate defensive capabilities, you know, because these companies and you know, and AI capability, they they are going to be

28:06 released whether we want them or not. They're going to be leaked. employees are going to leave companies that have the skills that they then can go build their own and openw weight it right um smaller models are going to become more powerful in certain domains and these large front frontier models as well right so um so I think that's that's the that's the debate right is how can we release you know these types of frontier models um in a framework such that the defensive posture can accelerate faster than the offensive

28:33 posture can uh because you know broad innovation is going to happen research papers are going to be released, you know, people are going to be building uh and and you know, taking models, right, and uh releasing them. So, it's like this slow diffusion, right, that's going to happen. But, um but that's that's, you know, sort of top top of mind right now.

28:54 Um but I think, you know, we leave live in an exciting time and um there's lots of opportunity for both offense and defense to get that equilibrium, right? That's that's healthy. >> That's right. Well, Dustin, maybe um like there's a final angle I want to touch on for this story, which is obviously right now we're all very focused on like the the zero day, the technical exploit, you know, all these sorts of things.

29:15 The normal adage, right, in computer security as well. It's it's ultimately social engineering that gets you in the end. Um and I'm really interested in whether or not you think that like you know these models which have been so good at say finding vulnerabilities in computer systems uh eventually we'll have really good well good is the wrong word really scary applications I would say in these other parts of computer security like social engineering like is there a bunch of kind of cognitive vulnerabilities you think

29:43 that like there will be a mythoscale event around or is that not really the right way to think about this? Well, that's actually the way it started with was AI was like if you look at say social engineering, it used to have the Nigerian prince here to go sell you a car somewhere in, you know, wherever. >> A million dollars for >> a million dollars. They typos everywhere and that was the issue.

30:00 Now, like they've got automatic tone matching. Deep fakes are a big thing. So, like that that came first. Then the vulnerabilities came second. Um the cool part I want to bring up though is there's this conference called pone to own Berlin where basically all the hackers come together they bring their best zero days and norm in previous years they've had no problem fitting everyone in this year they had to turn away so many people because there was like three 400 people that all submitted and they didn't have enough

30:28 time to fit everyone in the schedule and with the number of patches that vendors are pushing out rapidly because they've got their own code scanning happening with Mythos it actually shut down half of the uh people who are submitting to this pond to own. And so there's this whole big uproar going on right now. So AI is definitely playing a factor and it's stopping things before it comes out.

30:48 >> My key thing is most companies can't even patch when a patch gets released. So why am I worried about zero days when I've got these 1 days or 15 days, 30 days for a while, right? Like between copy fail and dirty frag, the bugs all came out, patches came out. Um but am I going to be able to get that system patched within 30 days in regulated environments?

31:06 Like this is the part that's hard. So, we just need to adapt the industry to things moving faster. That's the only real difference. >> Um, well, Dustin, uh, that's all the time that we have for today, but this is great having you on the show, and we'll have to have you back, uh, very soon. And Aaron Kush, thanks for joining the show today. You're some of my favorite guests to have on, and we'll have you back on real soon.

31:29 All right. Well, we've got Brianna Frank joining us, who's the vice president of product and design for Cloud Platform. Uh, Brianna, welcome to the show. >> Thank you so much for having me. Uh let's just start with Red Hat. I can I think hear the crowd a little bit in the background. Uh you're there right now. Uh obviously one of the big conferences of the year for the space.

31:45 Um I'm curious about what the what trends you're noticing on the ground, what you're seeing, uh and what you think about where it takes us going forwards. >> Yeah. So I think it's kind of interesting because the tagline is you know is all about what's next. And I do think that you you know when you talk about AI every a lot of conferences everyone's talking about like this new gadget or this new uh technique or um but I a lot of the folks here are thinking more holistically like AI is already here.

32:14 They're not really thinking about how to do a P or even how to get the first um AI application into production. It's more about how do you scale and how do you solve those really harder enterprise problems? How do you secure AI? How do you put guardrails in place? How do you have consistent architecture on prem and in the cloud? Um, you know, how do you handle when models upgrade and you're using an older model that might break your app?

32:38 Like all these kinds of more enterprise nuanced uh >> Yeah, we're like in the real world now. >> Real world. In real world. And all everyone's more of a practitioner. They've already embraced AI. There's really no one here that I've run into that's afraid of, you know, AI. they're really embracing it and saying, you know, they're excited really about what's possible and what's next.

32:59 >> Well, and so it sounds like I mean there's a lot of kind of like just very practical struggles people are dealing with here, you know, see just about like when when do you switch models in and out and kind of the administration. Um we were just talking with the panelists before you joined about how, you know, it's kind of funny. It feels like in the last few months, Anthropic and O OpenAI have suddenly signal that they're really going to get into the kind of consulting business.

33:19 Um, and I'm kind of wondering like how much of this we're now almost entering like a a kind of consulting integration phase for the technology where a lot of the work now is just like how do you steer your big company to actually benefit from this technology? Do do you agree with that? >> I do. I um it's interesting because I ran into a former colleague who had retired and uh you know we'd worked together years ago and he came back into the business as a consultant for another company and he's just so excited because

33:49 transformation is really something that excited him and he was telling me about the kinds of things he's doing and I do think that in order to really unleash the benefits of AI there is a transformation that's needed and I think what's fascinating is a lot of it has to do with behavior first before the technology and we have to change the way that we are working.

34:08 We might have to document more things. We might have to be more transparent and you know have less meetings where we're kind of talking to talking to each other not documenting unless the AI is documenting it for us. So it's right so it's changing the way that we're interacting and I think that's the first step is changing our behavior so that you can then apply an agent to your workflow.

34:32 But um I think that's what's fascinating. I do think that a lot of companies are going to need help because individuals are on a different there's a scale and some folks are just starting their AI journey and some folks are just all in and they're doing incredible things and they're you know on the weekends you know just for fun but you know not everybody's in the same space and so I do think that consultants coming in and like really helping companies change the culture because I think it is a culture problem first

34:56 and then you you start you know applying different tools and processes and uh But it's it's all it kind of starts with, you know, the curiosity and the willing to learn and maybe the willing to change how you've been doing things. >> Well, I know uh I would be remiss to not mention it sounds like IBM's got some big announcements uh for this year's Red Hat.

35:17 So, if you want to tell our listeners about them. >> Yeah, absolutely. So, we had two really big announcements uh yesterday. One is that we announced uh Red Hat Open Shift virtualization which we had a fully managed uh virtualization uh tile in the IBM cloud catalog and we also uh launched Red Hat AI inference and we've had Red Hat AI as um as an add-on to our uh to our platform for quite some time but this is a standalone service.

35:42 It makes it super easy for uh enterprises or you know any user to come in and you know run their inference workloads. It's kind of covers up all of the complexity of having to pick which GPU you want to use or you know I what's what's kind of interesting too is I talk to clients and they're uh they're courting GPUs or they're having political battles over who gets the GPU and then they're overprovisioning those GPUs because they don't want to give them up.

36:10 >> So if you're using an inference service what you could do is kind of eliminate that. You only pay for what you use. You can scale up and then you don't have to fight your colleagues for the GPU. So hopefully it you know it maybe it provides a little bit of world peace in the in in the in the corporate world as well >> like to like you know bring a truce to the battle.

36:27 >> Exactly. Exactly. But uh so we're super excited and that is um a really fun I run both product and design and that uh product is an award-winning design. We it's a red dot award-winning design. So, we're really excited to just add another component to it and make it super easy to use because I think if we can make the user experience really accessible to more people, they can unlock, you know, the benefits of AI and they can really do transformative things.

36:52 >> Yeah, that's great. Yeah, it's so interesting that uh, you know, I've heard about those battles playing out, of course, in like the big AI labs. It's sort of interesting that that battle's now everywhere where it's like these are my GPUs, you can't touch them. >> It is. I love hearing about these stories and you know how how folks are kind of you know that it's almost like you're a a startup and you're pitching your idea and like am I is my idea worthy of these GPUs.

37:13 So I think it's a healthy competition but it's also really fun to hear about sometimes. >> Brianna, what last question maybe for you is I understand you look after both product and design. Um and the word design I think here is so interesting. You know I come out of the AI space where it's just like well once the model is big enough and powerful enough it'll just solve all the problems.

37:30 uh which is I think very much like a not a design way of thinking about the problem. Um and so kind of curious as someone who's in the space leading this team kind of trying to think about where things are going, you know, what do you think is happening on the design of these systems? Like what what are the trends we're going to see in the next 12 months?

37:48 >> So I mean I think 12 months is pretty hard to predict to be honest. I think it's a monthby month. >> It'll be flying cars and who knows where we'll be at that point. >> Exactly. Exactly. But I do think um you know when we think about design I think sometimes a lot of folks kind of hone in on visual design or maybe that you're designing a new feature but they're forgetting that we really need to design experiences and so really everything uh you know the the world is going to start to expect a user interfaces are

38:16 going to expect that you know uh information is very easily accessible and that AI helps them complete tasks. So each product that we develop is really going to have to be designed to get the best out of AI and that will take some you know design experts to think through that user experience and make sure that the right data and metadata is being exposed so that you can get the right output and so I think that we have to just make sure that we don't forget that you know design is more important than ever because the

38:48 expectation of the world is is changing drastically and so for all products for all software for all SAS the bar is going to get higher. And so I think, you know, design is more important than ever. >> Brandon, well, thanks for taking the time. I know you're in the middle of this conference. I appreciate you spending a little bit of a few minutes here with us ate just giving us the latest on what's going on.

39:08 >> Absolutely. Well, thank you for having me. >> Yeah, thank you. And thanks to you listeners. If you enjoyed what you heard, you can get us on Apple Podcast, Spotify, and podcast platforms everywhere. And we'll see you all next week on Mixture of Experts.