AI exposes a major web security flaw, plus a new kind of voice model Transcript, AI Summary & Key Points

00:01 I just think it's incredible that someone who made a wrote some code to not have to write any code um for his personal homepage, you know, has exploded into powering 70% of the internet. All that and more on today's mixture of experts. I'm David Zach and welcome to Mixture of Experts, IBM's podcast in which we bring together a panel of IBM experts to talk through the week in AI news.

00:26 My guests today are Ash Minhas, a practice manager for technical content, Judith Aino, staff writer at IBM Think, and Jessica Nahulan, master inventor and life cycle management team lead for IBM business automation workflow. Later in the show, we'll also be joined by Kio Gabriel, who is going to report from the field and he is the IBM field CTO for data.

00:45 He is at IBM Tech Exchange, which is our annual conference for builders, engineers, hands-on demonstrations. So, we're looking forward to that. First, we're going to talk through three AI news stories. So, we're going to talk about Desa, a new model from Block that was trained on voice conversation, no text. We're going to talk about a new benchmark called cultural riddles that is meant to stump AI models uh with riddles about with that are culturally specific.

01:11 But we're going to start by talking about a giant bug. First story is about PHP2 shell. This is a a big bug that a couple security firms found and it's part of this broader trend of AI discovering security vulnerabilities. This one is particularly large. Judith, could I start with you? Could you help us get oriented like what are the the two or three most important things we should understand about this PHP exploit?

01:40 PHP is a widely used programming language that powers about 70% of all websites and these vulnerabilities can allow an attacker to remotely take over a web server. But um besides that, the problem is organizations that are running older PHP versions can't just upgrade and patch because that could disrupt other legacy systems built around it. The somewhat good news, as our friends at Security Intelligence mentioned, is that the exploit chain isn't exactly easy to take advantage of, but it still shows how vulnerable we

02:25 are as um given the fact that these security flaws were found with AI models which are making it easier to find vulnerabilities to exploit. >> Ash, can you help me understand the scale of the problem? Why is this? Obviously bugs are discovered every day, every week. Why is this one that began to sort of trickle into front page consciousness? >> You know, there's so much of the internet that's um powered on web servers that that run PHP.

02:52 And so um this particular vulnerability allows an attacker to be able to remotely execute code on a server that is exposed to the internet or you know other uh aspects of you know access that it may have. And so when you think about sort of a typical um web architecture, you're going to have things like databases like attached to that server in order to like be able to query something and provide information to whoever the user is on the internet.

03:27 And so it's the fact that you can take control of that thing and then have network access to networks you shouldn't have access to. you have access to credentials that you may not or shouldn't have access to and you're able to just in essence use that um computer as you would like to in any nefarious way that you can think of. So in essence, it's like um having the keys to like a someone else's like hotel room for example.

03:57 Okay. Long after you know you know you should have and being able to do whatever you like there. And yeah I mean that's ultimately the the crucial vulnerability that that's exposed here is like all these websites out there can have this problem. Now you know you'll find that like in large organizations there'll be um architects who will have architected their web servers to kind of like be segregated from a network perspective like they'll have them out in a DMZ.

04:25 They'll have like web application firewalls in front of them and so forth. But none of those defenses are going to be able to protect them from this kind of issue. And then you know if you think about uh other people who have PHP servers you know they might be smaller businesses or individuals they don't necessarily have that complex a network topology and therefore they just their their servers are just basically sitting ducks on the internet.

04:50 >> So so I think what I hear you guys saying is that um there are at least two reasons that this is really at a headline level bad. one PHP it's not like like most bugs it's like this one software program is affected oh Microsoft Word has this you know little problem and they'll push a patch and it'll automatically update and and then then it's no big deal but this is actually I gather a bug that exists in this fundamental language itself like not a product but a language that undergirds this it's like it's like a bug

05:22 in the infrastructure almost of the web Jessica you uh am I right that you have I mean you're a master inventor of many patents you you build things I'm gathering you've probably built websites uh that that use PHP how are you actually as a practition practitioner who's um you know maybe put things out in the wild that are uh affected how are you thinking about this right now >> I think the way everyone needs to maybe change their mindset now is we've we've built like websites solutions whatever small businesses like

05:52 Ash mentioned might have put up we've built all these solutions we put them up We put them on the web and we've moved on. They're running well. We can uh drop them out of people maintaining them or even looking at them cuz they're all fine. Now we have AI and with AI we're able to at this rapid pace uh both discover vulnerabilities um attempt to exploit them and and now we have to revisit all these things we somewhat abandoned and look at um you know what dependencies do they use?

06:23 Was that built with PHP? is that using um some open service software that has only one maintainer and they only patch fixes once every two months. We had to look at essentially our full stacks and and see how we can modernize and evaluate um what we use. So it's it's honestly um so that's so from both small individual businesses to big enterprises that's a huge cost.

06:46 Um before modernizing was almost like this nice to have. Now everyone is forced to modernize so that we are ready to pick up the latest versions of um these fixes and these dependencies without breaking our infrastructure. >> I think one of the things that interested me about this story is um the story of how how the bug was discovered and how it was disclosed and if you really look at the timeline it's pretty complex.

07:15 there were well first of all the bugs were sort of half understood or something like the bugs were understood in previous years but it wasn't thought to be quite as severe um then this summer uh independently a firm called whiz and a firm called California um uh started directing their AIS to sort of uh look poke at PHP and see if they could find uh flaws and uh they sort of simultaneously discovered these flaws.

07:43 Whiz and California began talking to one another. They began talking to the entity responsible for maintaining PHP code, which is something called the PHP Foundation. Uh that foundation, it turns out, despite managing the code that undergurs 70% of the web, has one full-time employee. Meanwhile, Amazon put out a a honeypot server. Even before the the the exploit was released, somehow someone attacked the honeypot server with this exploit suggesting what?

08:15 I don't really know. What are your thoughts about that? Ash, one of the reasons why so much of the internet runs on PHP. It's probably WordPress. Okay. WordPress runs on it. Jumbla runs on it. Okay. you know, I've had personal experience setting up all of these things for like friends and family members, as Jessica was alluding to, like in in past lives.

08:34 Um, the alarming thing, as you said, is that there's one full-time employee for the PHP Foundation. And I think that um um one of the things that we take for granted as a society of open source software is that if it works, we just use it. and there's an assumption that it's someone else's problem or responsibility to maintain and and and react to situations such as what's happened this week.

09:04 And um I think that there needs to be a rethink around how people who are consuming open source code are investing back into that ecosystem because quite simply you know there's time money and resources required um to to solve these things and with the advent of um generative models and AI agents and finding vulnerabilities and exploits quicker than a human being can without an equal level of investment in that time and money, okay, and resource.

09:37 Um, it will be very difficult for us to sort of like try to close that gap between discovering something and being able to resolve it. >> The exploit the in the in the parlance the common vulnerability, the bug is called PHP2 shell. But the language itself PH2 PHP uh originates with the someone invented it uh how many years ago? Ash Rasmus Lurof made it and he made it in 1994 and you know it obviously got a lot of traction and he's s very very competent programmer but at the time he would joke and say I'm not a real

10:12 programmer I just threw this thing together and moved on and uh um he actually wrote it to program less and so it's I just think it's incredible that someone who made a wrote some code to not have to write any code um for his personal homepage age, you know, has exploded into powering 70% of the internet, >> right? I mean, I I sort of feel like it would be like waking up one day and being like discovering that all the concrete that New York City is built on was actually just like, you know, baked in someone's backyard

10:45 and he was playing with his kids Play-Doh and he thought it'd be cool and everyone's like, "Give me some." And then they built a city on top of it. Um, and I I I don't know like my analogy is probably imperfect there, but what broadly what does it mean when our digital infrastructure like if you start drilling down into the archaeology of it often it's just something cludged together like the kernel of it is something cludged together by some dude in 1994.

11:12 Like is is that a problem we should be worried about? >> I think it's a big problem. And so like I I'll speak from personal experience here. Okay. And you know I'm when I say this there's probably so many technical members in the audience who are going to listen to this and go yeah I know exactly how that feels. Um the world of technology is layers upon layers upon layers of abstraction.

11:34 Okay. What we do is we take complexity we turn it into an abstraction layer and then we build on top of it. And as a consequence of that, I just think as a society, we've never ever stopped and taken sort of a first principles approach to how we make software. We just go, "Oh, in order to me to make that thing, I just have to import this library and I have to import this dependency and I have to import this thing and like I don't really need to know how all those things work.

12:01 I just need to know if I import it and put, you know, the import name and run, it will do what I want it to do." And there's not enough like sort of like a sort of mental bandwidth there around what is this thing that I'm importing and where did I get it from and why should I use it and like you know is that the right thing to use and you know can I trust it for the thing that I'm going to do next.

12:22 I do wonder like running with the physical analogy like presumably when they decide to presumably if I dig into the archeological layers of of this road outside my home like the further down you go you'll find less sophisticated building materials but presumably when they modernized it they made structural engineering decisions to make sure that the whole thing is fundamentally sound and like do do these could you tell me a little bit just as someone who's new to this world about like practices of code modernization

12:51 and like best practices of just sort of making sure that the the kernel of a thing is is safe. Jessica, do you have any thoughts about that? >> I would say there's the the ideal world of the reality. So, there's a lot of best practices around exactly what you described. Um, you know, a lot of people do want to rearchitecture these complex like 30-year-old systems and and see how we can do better.

13:15 But then um the reality is then there's timelines, there's resources, there's maintenance, and then just sticking sticking glue and tape and everything else on top. It just becomes easier and then you kind of have a little cupcake on top of your little broken bucket or whatever whatever you got going. Um and and then that's kind of the reality. But I do believe that AI is built also giving us this opportunity now that now rewriting code and and understanding code where the experts aren't even there anymore cuz it again

13:48 it was created maybe by some team 50 years ago and you don't have them to speak to you. Now all that's so much easier with AI. So I do think um like like this news article exposes the an issue that now we are finding issues faster than ever but we're also capable of fixing them faster than ever. >> In a moment I'm going to move us on to our second story which is a really interesting one about a AI model trained only on speech.

14:13 Uh before we do that if you happen to be listening to this watching this on YouTube it's really a big help if you could just click like subscribe maybe drop a comment tell me uh what you think of my outfit today. it it helps us uh you know engage the algorithm and and grow the show. So, thank you for that. All right, our second story today, this one I I'm I really nerd out on this sort of stuff.

14:38 Um model architecture, new new modalities for models. So, this is about something called Desa. Um it comes from Block, which already this is interesting to me. Block is Jack Dorsey uh Dorsey's company. Block makes Square, the payments processor, Cash App, the other payments processor for cooler people, and uh also owns Title, the you know, Spotify competitor.

15:01 But uh if if if we know one thing about ATJ, he's always tinkering, always got things up his sleeve. Apparently, uh five, six years ago, he bought an AI, um frankly, was kind of like a deep fake firm. They made a they got famous for making a deep fake voice of Joe Rogan that just sounded just like him in 2019. So they've been cranking for six years apparently and they have uh they announced that they have created a model that uh was only trained on voice conversation.

15:34 So unlike the LLMs that we're familiar with the GPTs, the ClaudS um basically are really really scholarly. They read a lot of text. This model did not read any text. It only listened to human conversation and uh nevertheless was able to uh is able to hold a conversation and to do so in a way that uh well why don't let someone else explain that. Judith, what what is so unique about Desa?

16:04 Were you able to listen to any of the the demos or were you able to Yeah. Why don't you tell us what's kind of uncanny and cool about it? first thing um is that it can listen and talk at the same time. So versus other models where they're silent and wait until you're done talking. Um from the demos, you could hear it interrupting people. um even with just like a laugh or like the things that we tend to do when trying to show that we're engaged in a conversation.

16:39 So that immediately jumped out at me. >> One of the coolest things it can do is say m while you're talking, right? >> Yes. >> So I I I apparently linguists call this back channeling. And like, you know, if I'm talking to anyone and trying to show them that I'm engaged, I'll just go m and the fact that it can do that in like a socially graceful way is a massive technical feat uh apparently.

17:04 And it really comes down to to training on that on that audio. >> So far, I mean, we should note that it hasn't been publicly released yet, and we haven't seen really any research or uh much about the methodology behind it. So, we're still just going on uh what's on their demo website. >> Yeah. Ash, were you was that curious to you? Because um uh there's this there there wasn't a paper.

17:34 There's also so this this kind of model that can talk and listen at the same time is called fully duplex. I think uh it sounds like a real estate term, but it's about the I guess the the dual channel and the model that can listen and talk at the same time. Um but uh there is a fully duplex there's a duplex bench that they could have said that we scored off the charts on it.

17:54 They did not share that score. They did not share any numbers whatsoever. But Ash, what did you think about this? Um and you know where does your skepticism lie given that the details are scarce? The fact that they're saying that they didn't train it on any text suggests to me that the amount of world knowledge that this model has is more limited because you know if you're training it on conversations itself then you need lots and lots and lots of conversations right um and so as we would find you know with with with

18:27 early like uh transformer models I mean this isn't a transformer model, but uh it probably would have exhibit the same sort of like behaviors is that it probably would hallucinate a lot. I would say because it doesn't have as much grounding. Um the thing that interests me more than anything is that um we have all of these benchmarks for all of these models like you know you've got like MMLU and you've got like these coding benchmarks and so forth for uh you know the the the Frontier models and any other model that they

19:02 can run against it. I don't know if there is such like an audio benchmark. I mean like how do you benchmark and test this thing? Okay. So if they even if they did want to release some thing in their research, it's like what would be the benchmark that they would be using to do that, it's like I think right now one of the things that Desa has like to to contend with is how do they show the world controllability of it evaluation, you know, how does it handle hallucinations?

19:37 I mean, I think all of those things are still open questions. >> Apparently, in someone's demo, uh, it really likes to call people Reinaldo, whether they're named Ronaldo or not. So, it it works really really well if your name is Rinaldo. >> Mhm. >> It aces the Ronaldo talking to Rinaldo benchmark. >> Maybe that's how they train it. You just got to like, I don't know, open up an app or a browser and just keep talking to it for the next couple of years.

20:03 >> Eventually, it convinces you your name is Ronaldo and then it works perfectly. Frankly, I was I was surprised to see AI News coming out of Block. They weren't on my radar as a frontier lab to say the least, but they've done something clearly impressive in the demo. But what's your reaction? >> Honestly, um first very impressed cuz it's the first time I I've even listened to an agent speak in that in that uh duplex way.

20:23 But honestly echoing Ash in that the first thing I uh as soon as I read that they how much text they essentially train this model on my my thoughts were well then it's everything I dislike in a model it's inaccurate it doesn't know the right answers the the worry thing we we choose our model on it fails at right or or I assume so I have to believe that you know um you're getting his hallucinations it it doesn't know the answer anymore.

20:54 So what value are you getting? So one thing when when Ashes again he talked about the hallucinations I was thinking hm maybe that's actually a good thing here cuz now you're getting like the randomization of a unique um human personality in some senses though it's also quite interesting because if I was to describe this um dup uh dessa to you I'll be like it can speak to you but it can now interrupt you.

21:23 That sounds great. I want I totally want to be interrupted by MLM while I'm trying to ask it something, you know. Um, so I guess a lot of skepticism on um its performance and like how much it knows, but I think it's unlocked this whole new avenue and it's like how do you even grave that avenue like Ash was saying. So, um I was listening to him and I was thinking there's whole new criteria here cuz now we're not even grading it on cuz usually when we want to grade our typically like claude or L models, we're grading it

21:55 on how accurate is it, how right is it, how consistent um is it reliably able to answer something. But here maybe we want to like grade that if I go what was that buoy like like it catches that I'm trying to think and it can interrupt and jump in. How do you grade that and evaluate that? It's a whole new criteria because you're trying to um kind of evaluate nuances in human speech and expressions and just even the noises we make.

22:25 >> Well, it'll be interesting to see what happens for now. It's just a research preview and a kind of private beta for uh security testing. Um, so we'll see if this becomes a product and it'll be interesting to watch. For our third story today, our third and final story, we're going to talk about a pretty unusual benchmark. Um, so we were just talking about benchmarks in the last segment and and just for those who don't know, a benchmark is basically kind of like it's kind of like an SAT test for for models, right?

22:52 So, um, people devise these tests, whether it's a difficult math test or a diff difficult reasoning test. you test a bunch of models against it, you see how they fare. Um, and uh, this one is about culturally specific riddles. So that actually has two components, and I think it's worth taking them one at a time first. So um, uh, let's start with the riddles component, which is kind of the the more interesting half of it to me actually.

23:21 we sort of know it's not it's not okay but we we be definitely know that these large language models that are trained on uh huge corpuses of mostly English and western languages on basically the text of the internet which is not representative of all the countries in the world we've we've known that these models might have a tendency towards their training set but this this theme of of testing models on riddles uh why and how did this emerge because this actually is a a practice that even precedes the launch of Chad at

23:50 GPT. So Judith, I asked you to read up on this history a little. Could you brief us a little bit about why we're trying to why we're playing like Riddler to Batman with models at all? >> One of the reasons is riddles are especially for models can be incredibly difficult to solve since it's not just about pattern matching. You need creative thinking and word play to solve most uh riddles.

24:18 And so when we're testing the um effect effect effectiveness efficiency of a model, riddles are a really good um benchmark for them. Sticking just to the riddles component of it, like if you think of the the canonical riddle for me is the one that Edipus solves from the sphinx, what walks on four legs in the morning, two legs at day, and three legs at night?

24:41 the answer man or humankind because and it requires stretching your brain a little. You're thinking about legs in a different sense. You're thinking about times of day in a different sense. The baby crawls on four legs in the morning at the beginning of life. The adult stands upright. The the the uh the elderly uh man or woman walks with a cane. Night being the nighttime of life, right?

25:02 It's this metaphorical use of language that initially the presumption was that our C3PO's wouldn't understand that Ash, right? Um, so, uh, Ash, um, when you add in this level of of cultural specificity, were you able to to dig into the paper at all? And what do you think happens when you, um, both kind of brain tease a model with respect to these this riddle-like stretching of language and then also kind of demand of it cultural spec specificity?

25:32 What do we learn about models here? I know you love benchmarks by the way. >> I do indeed. Um, David, so so first off, you can actually go to Coher's cultural riddles paper website and you can do a quiz. So you can kind of do a quiz and test your knowledge against an AI. Thankfully for me, I outbeat the AI. I think I got a score of like 80% or something.

25:53 It was actually pretty fun. I recommend you can go and like anyone wants to just go to their website and do it. I hope that they're collecting that as training data. Um what this exposes is far bigger than a riddle or you know like cultural awareness. What this exposes is something that even OpenAI probably put some uh research out about I think last year or the year before is that um we just like the entire space of benchmarking needs to evolve right and let me explain why I say that right all large language models

26:32 the benchmarks that they get benchmarked against you if you get the answer right you get a point if you don't get the answer right you don't get a point, right? But also if you don't know the answer, you don't get a point. Okay? So the models are incentivized to guess, right? As opposed to cuz you know they think about it and they go, you know, if you ask a model, what's my date of birth?

26:56 Okay, mathematically there's like a like there's like a if you just think about, you know, the day of the year, okay, there's like a 1 in 365 chance that it's going to guess it right. If it says I don't know, it's got 0% chance of like getting a point, right? And so it's incentivized to like go I'll I'll just make one up because mathematically I'd rather take that chance and have like a you know a 0 whatever percent likelihood of me getting this right versus not getting anything at all.

27:25 I think that um we need to rethink benchmarking in in totality in regards to like how we evaluate these models. Um yeah, in regards to the actual question that you asked me, um I think the the the great thing about culture and like you know society and so forth is it's like a moving goalpost like our cultures evolve. It doesn't stay still. Okay? And so it's very very difficult unless you have super fast training runs and you've got all the right source data to go into training these models for them to be able to

28:01 respond appropriately. >> Last question, Jessica. I'll keep it open-ended. What interested you most in the cultural riddle study? >> Oh, what interested me most? I I guess it was um I was thinking back to a conference that actually ran this week from IBM Tech Exchange. I'm not sure if he caught this. So Tim O'Reilly was one of the speakers and he talked actually he he commented on um uh he he made a parallel between words and essentially the context they hold and magic.

28:29 And let me explain that. So essentially a word and your prompt it it holds a representation that then once you type it it it expands into a request right and essentially now we're able to package our perfectly written um you know requests and and share them in the tech world right share these skills share these agent uh workflows and that's like casting spells in a way and it really makes you think about the power and the context that every single the world has.

29:02 So, for example, if you say, "Write me a PRD, that means a product requirements document." That three-letter acronym, uh, it expands into this whole structured text. And from company to company, what a PRD looks like might be different. And I think that's very interesting because it's almost like what's happening here cuz um every word from culture to culture might have different kind of a different sense of interpretation of what that word looks like and then the entire request changes completely.

29:32 So it's that takeaway of really understanding the context of the languages and who your audience is. Right? So if you say you support um you know people from all around the world or certain local actually test with uh with the languages that they'd be using and how they uh might uh and how they make sense of the world essentially. >> I love that you brought in spells.

29:57 I think the ultimate benchmark should be expect >> and when a model nails that we're in trouble. Um or we're very safe maybe both at once. Um thank you so much for covering these three stories. We have a special bonus segment that you teed up perfectly. Uh we're going to bring in I guess to talk about tech tech exchange in just a moment. Okay, we're joined by Kio Gabriel for a special segment.

30:26 Kio is the uh IBM field CTO for data and he joins us from Atlanta uh on the day we speak the 29th. This is the last day of IBM Tech Exchange and Kio, you've really sold me on this as being uh uh a really exciting conference. You said it's full of boring stuff, but actually what you said is boring. It's that the story is that the boring stuff is becoming really exciting and maturing.

30:49 I've been going to like all the big conferences for the last 3 years and it go the hype thing. There's a wave. There's waves. It's like at first it was like vector search and retrieval augmented generation and it was AI LLM model training. Then we got into uh you know over the last say a year and a half it's all agents and then you know some coding agent stuff.

31:11 But what was really awesome about Tech Exchange is we're starting to see us getting our hands around things like agent identity orchestration, you know, process orchestration, monitoring, and all of these things are they're old, but they're also new. Like the way that we have to do these in an agentic world has changed in many cases. Uh I I would go so far as saying fundamentally.

31:38 And one of the things we introduced was the streamhouse which is really just giving a name to a new a data architecture that some of the like the biggest companies in tech have been using for many years. It's just that if you didn't have those like big big you know uh AI native or technative companies so like a you know we talk about like Uber and Netflix if you didn't have their data problems you didn't need this class of architecture.

32:02 But now if we look at sort of the way that that the the volume of agents that there are and the way that the data exhaust that agents create um we're seeing companies that are have used to have much lower data needs now they're going to need that kind of platform and that's what we're bringing to market around the streamhouse just as one example. So lots of it's sort of like the old is new uh and we're we're getting into the the maturing cycle of AI.

32:28 you were speaking about how especially in the opening moments of of sort of you know displaying some of the things that have some of these mature technologies people were getting really excited. Let's start with Streamhouse since that's kind of your wheelhouse to double up on the house metaphor. What is Streamhouse and what has really matured in the last year that you've been able to present something really new and exciting to to to IBM clients and other folks?

32:50 >> I think that we we've seen a lot of companies gravitating to a lakehouse. We we went through warehouse and it was data lake and we went to lakehouse. These are all different ways of sort of housing data, right? So a data lake is you just kind of dump it all in and worry about it later. A warehouse is is something else. Uh streamhouse kind of brings some ideas together.

33:09 Is that right? Yeah. I mean the warehouse is like structured archival. Data lake is throw all everything in the trash bin. And lakehouse is trying to recognize the strengths of both of those. Like I want to be able to have structured and unstructured and I want to be able to separate compute and storage. Those are sort of the pillar value props of the lakehouse.

33:27 The challenge is that now we're starting to see, hey, I like that scenario. The reality of my business is that my my data estate is distributed, which you could also refer to as fractured. And uh and so we need a way to pull all that together to bring context to agents so that agents can act on it quickly in an operational context. And so how do you do that with a lakehouse that was really not designed for the for an operational context?

33:52 And and what we're showing is that with this sort of shift left technique of saying taking a lot of the way that we handle data in the lakehouse and running it in flink so that's a processing framework in the streams in in you know streaming platforms uh that suddenly now we can do a lot of that and deliver the operational needs of agents in in uh real time.

34:15 Obviously IBM in the past year or two made this big acquis acquisition of Confluent to enable a faster moving data so data is where it needs to be for agents and others. So bringing all these long-term themes of agents together and it's sort of this kind of like archipelago of ideas that's it sounds like it's converging to a really exciting moment. What is one concrete kind of cool application that an IBM client could not do a year ago that now they can do now that streamhouse is a thing?

34:43 >> Yeah, that's a good question. I'm going to twist it just a little bit. I think and I and I like I I did the keynote. I talked about this there. Um it's it's that historically streaming architectures have been hard to build. The way that you have to think about stream processing, especially what's called stateful stream processing, it'll wrap your brain around an Axle.

35:06 And now with AI, it's just sort of it's interesting timing because AI is creating this problem that allows that requires more companies to use this new architecture. But it is also the solution. I can write stream processing stateful stream processing jobs using AI effortlessly. I can take jobs that I've been defined in the lakehouse and say, "Hey, just rewrite this."

35:25 So the important thing that this unlocks is that most people because streaming architectures were hard, they would gravitate to what they know, which is a a request response style architecture. Most of us we we came up through or we were educated in that. Almost every web app anybody's ever built, most of their mobile apps they ever built, they're they're kind of layered on, hey, I'll check for data every now and then or I'll query for it and I'll, you know, update it.

35:52 It's very request response, right? streaming architectures are better because it allows me to with lower resources be able to make my apps more responsive. They get updates right away and uh the whole thing starts to feel more organic but it's harder and that's why fewer people have done it. Well, now those barriers have come down and we can now, you know, say the request response architecture, I understood it.

36:18 That's why I built it, but now I can actually build what I really wanted, which was a better solution for many problems in, you know, small and large businesses. We just couldn't build it, but now we can. The advent of agents are pushing more and more businesses into a corner where they they maybe they weren't maybe maybe you didn't have a big data problem or a big you know concurrent user problem previously and suddenly with agents you do and now you need to think about rethink okay what is the right solution for

36:47 having this new data problem that I didn't have before and and the same thing actually starts to spiral with identity well identity is as old as computers you know I sign in but now what happens when you have these these agents that are autonomous, they're not people, and there's, you know, maybe an order of magnitude more of them, and I need to make sure that they only have very shortlived credentials and things like that.

37:08 IBM has fantastic solutions around this. So, but they're they're different. The problem, it's like it was around before, but it's manifesting a new with agents and we have to and it's causing us to to approach the solutions differently. And >> what feedback have you gotten? Have you talked to any clients or or friends of IBM who are excited to to try this out next year?

37:27 Yeah, I had a had a great meeting with a major insurance company and uh they're they're looking at this and they're saying this is the solution that we've been looking for actually for years and uh it's it's they're starting to see how it can suit them, how how this is I think this is an interesting situation because typically in most enterprises the operator the people who are responsible for keeping things running in many cases they they really don't know the specifics of what's going on in the systems that they done

37:56 and that creates this interesting uh tension and barrier between the people who build the stuff and the people who run the stuff. But now with AI, it's that's also really empowering both of these groups. You know, the people who are just who are just operators and they really don't know. Now they can say, hey, I can actually be a better service to the people who are building cuz now with AI, I can actually, you know, understand what how my systems are being used.

38:20 And likewise, the people who are building can say, okay, now I understand how my software leverages the underlying systems and where I may be causing problems for those groups of people. And I think that it's really cool to for people to start to to see, wow, with AI, it's not just about, oh, I can make cool images and I can write code. It's could transform the way that you actually execute your job and the way you actually work with other people.

38:46 It's it's very transformative to relationships and organization. And to me, I think people are starting to see that and that's really exciting. >> Well, that excitement is coming through. I I wish I could have been there in Atlanta with you. Uh, thank you for this report. Enjoy your last day there. Safe flight back. I want to thank uh both Kio and and our other panelists um Ash and Jessica and Judith for joining to uh for this week's mixture of experts. Uh tune in next week. We'll see you then.