[email protected]

Lost or something while doing tech for whoever pays me.

[[email protected] @MatthewBricker]

@UK_Daniel_Card I haven't looked too closely yet but at surface level it feels very much like Sofos and Pacific Rim... which was equally as interesting.

[[email protected] @MatthewBricker]

@aakashgupta So you're essentially saying.... He added a device to the bedroom...

[Dave Kennedy @HackingDave]

Alright, I've stayed away from the Mythos stuff for a little bit. Going to comment on that, but AI as a whole.

First, this AI industry is absolutely insane. I feel like I'm back in the 90s/2000s with innovation, but it's not tempered or methodical - it's pure chaos.

Everyday there is some AI-dude-bro (or gal) clawing for followers claiming end of cybersecurity, end of software engineering, or this breakthrough changes everything. We're seeing the "streamer" effect of video games now exploding in every industry that hasn't been in whatever industry, but is now a AI-expert thus an expert in anything AI touches because they can prompt.

Largely it's not, but what it is doing is requiring us to understand what AI will do to virtually every industry in the future. I'm sitting here right now at a conference I'm presenting at, and I spoke with an individual which was like man... I'm just trying to get through this SAP implementation at my company, I don't even know where to start with AI at the moment.

We are still in the extreme early stages of what AI can do, and I think that's really the exciting part - we are at the infancy stages of this.

Most enterprise can't handle AI, as most companies couldn't handle agile workflow when it came out either, it took time, but eventually adopted.

I won't dive deep into the scalability of releasing AI to the masses based on compute, power, or subsidies because these are real hurdles we need to solve. As you can see with Claude's spike in popularity is causing them to have to dumb the model down upwards of 65% just to stay afloat (Claude is absolutely awful right now for coding - beware).

Mythos is cool, really cool - but it's not earth shattering as claimed. The potential here we are seeing a glimpse of what can actually happen though.

The ability to do extremely complex tasks, with insane context windows, and high-end reasoning. But, what we saw from other current frontier models including open LLMs, they were able to find the same issues, but had to be specifically targeted towards those code sections because of context limitations and complex task reasoning which was drastically improved in Mythos.

What does this mean? Basically. Nothing. It's a lot of marketing hype - but it does prove out that as these models become smarter, it will inevitably produce much better code, be able to work in mind blowing fashions that we haven't seen before - but it will all come down to cost. Right now Mythos is extremely expensive because of the compute needed, and we may solve that over time, but it's not there yet.

The subsidies right now means AI is not ready. Scale is our biggest bottleneck right now and until that's solved, the industry will not move as fast as it could.

What's particularly impressive is how the open models are starting to perform on par (or better) with the frontier models and become way more efficient without restrictions (turboquant) as an example.

Our ability to use near parity models on our own hardware will only continue to get better which is a huge threat for these companies. I at first looked at Cursor's implementation of Kimi as they were falling behind because it wasn't "their own model". That wasn't accurate, its that the open models are performing substantially better than from 6 months ago, and will soon be leading the charge or close to it.

What does this mean for cybersecurity? The industry is changing rapidly, and I absolutely freaking love it. We needed a swift kick in the ass in this industry that was largely stagnant for the past 10-15 years.

What used to be a handful of incredibly talented security researchers that knew systems internals, savants at reverse engineering and reading through millions of lines of ASM is now being afforded to the masses, but still has a long way to go.

The reason AI is so good at doing this stuff is because they paved the way, and will continue to do so in different ways. Not eliminated or removed, enhanced and better than ever. AI is single handedly the largest theft of plagiarism that has ever happened in human history. I just got a 10K check from Claude for ripping off my Metasploit book to train its model to be smarter actually :P

I am all for things that make the world a safer place. Our goal in cybersecurity is to fix the world, make it less harmful when using technology - we should be adopting this. Note that it's going to come with a ton of fluff, hype, doomsday predictions, people that are now AI exports or coding experts but have never written a line of code themselves. That's all to be expected if you have ever been to an RSA conference. AI will product meaningful change in an industry that needed it.

Cybersecurity is much more than bugs or defects, it's protecting against risk. AI is a new emerging risk, it's going to keep us insanely busy right now, and for the foreseeable future.

[[email protected] @MatthewBricker]

@HackingDave I'm actually really surprised they don't include Bluetooth scanning as part of the Flock license plate readers. For all I know they do, but that would allow them to associate an "owner" to each car but also track people in the cars.

[[email protected] @MatthewBricker]

@HackingDave You mean inventory management 2k26?

[[email protected] @MatthewBricker]

Naming stuff is hard for people in tech, luckily I'm starting to get the hang of this AI thing.

[[email protected] @MatthewBricker]

@Lenstag Chrome just told me I should un-install your extension, but the web site seems up with my data. Is the extension deprecated?

[Accidental CISO @AccidentalCISO]

This makes me think of a lot of technical how-to videos on YouTube made by junior folks that are still learning and don’t yet realize the right way to do things. 🤣😭

[[email protected] @MatthewBricker]

@Jayalattar @cstanley How do you avoid that? Are you writing your own operating system? Everything we do is vendor reliant, from the hardware to the os, to the software we run. It's all about risk management.

[[email protected] @MatthewBricker]

@Jayalattar @cstanley What are you even talking about. Just because someone uses crowdstrike for AV on a Windows box doesn't mean they've outsourced anything. Are you suggesting companies should develop their own in-house EDR?

[Boyan Slat @BoyanSlat]

Congratulating #CrowdStrike for reaching its carbon neutrality targets six years early through its disruption of global air traffic today!

[Vincent Flibustier 👽 @vinceflibustier]

First day at Crowdstrike, pushed a little update and taking the afternoon off ✌️

[[email protected] @MatthewBricker]

Today's a great day to hug your IT person... Or at least buy them a cup of coffee.

Happy outage Friday for everyone celebrating!

[[email protected] @MatthewBricker]

Woah, big supply chain issue....
https://t.co/ppndZRUV5Z

[[email protected] @MatthewBricker]

I'm incredibly honored that I get to work with such incredibly smart people on the @10xGenomics infoSec team. They have their own cryptographic puzzle challenge coin and everything.

[[email protected] @MatthewBricker]

No one is safe. 😂😅

[vx-underground @vxunderground]

Lockbit ransomware group has ransomed... a small local bar with like... 5 employees? 😭😭

What are they going to steal? $15 and their winter coupon menu?

[Chris Bakke @ChrisJBakke]

Just got pulled over by the police.

I said, "Good evening officer. May I ask why you stopped me?"

He said, "Well, I noticed you were a middle aged white guy driving a Tesla and wearing a Patagonia vest. Just wondering if you've heard any information about what happened with Sam Altman?"

[[email protected] @MatthewBricker]

@sirvaworldwide any comment or public announcement around your lockbit ransomware and breach? When can I expect to be notified if I was affected?

[[email protected] @MatthewBricker]

Quick everyone update their dictionaries with all these new plaintext Passwords. 🤦‍♂️🤦‍♂️🤦‍♂️

[Have I Been Pwned @haveibeenpwned]

New breach: Horse Isle had 28k unique email addresses breached in 2020 - twice. Data included IP address, name, gender, purchases and plain text password, including failed password attempts, also in plain text. 77% were already in @haveibeenpwned. More: https://t.co/EJeDWWjfNk

[[email protected] @MatthewBricker]

Woah, what a blast from the past. Should make for a great talk.

[ᅟ𝖎𝖑𝖑𝖜𝖎𝖑𝖑 @xillwillx]

I'm dumping this before my talk at @bsidesct so I don't get distracted. Enjoy fuckers.
https://t.co/LnaE96R1z5
cc: @vxunderground