Keith Lawson

CISO | RL & Cybersecurity researcher at @umich | Linux grey beard | 🇨🇦

[Keith Lawson @j_klawson]

It was an honour to be invited to present our Security Gym environment at the @continual_learn workshop at the RLC conference. Have to admit it was a little intimidating to be sandwiched between @RichardSSutton and a panel of industry experts but it made for a packed room to hear my little talk.

Received some great feedback in the poster sessions that I can incorporate into the environment and paper. The reinforcement learning community is really great community that I'm looking forward to working with more.

[Continual RL Workshop @continual_learn]

The second oral talk of the afternoon session was given by Keith Lawson (@j_klawson):
🎙️ Security-Gym: Evaluating Temporally-Uniform Agents on High-Fidelity Linux Telemetry

🔗 https://t.co/4udqLdtfhJ

[Keith Lawson @j_klawson]

@esrtweet I spent the better part of my career as a sysadmin managing Unix and Linux infrastructure. I let agents do it now. They do an amazing job, save me a truckload of time and I don't miss doing it myself 1 single bit.

[Nicolas Krassas @Dinosn]

GitLab warns of max severity code execution vulnerability https://t.co/RTYfHgEkVi

[Keith Lawson @j_klawson]

@johncodes Most of these products need to be rewritten just as much, if not more than the commercial software that they endeavoured to clone. Spending tokens on new and improved implementations of software seems like a pretty good use to me.

[Andrej Karpathy @karpathy]

Dusting off this tweet from April because this gap in shared understanding of LLM capability is *widening*. It's now less "two groups of people speaking past each other" and more a sharp funnel.

- Napkin math somewhere around 6B people (~75% of the population) have barely come in contact with LLMs at all.
- Around 1-2B (~20%) are casual and infrequent users of free-tier ChatGPT-like products. This group sees derpy chatbots and treats them a bit like a better Google search, a writing aid, or etc. Maybe an agent tries to book you a flight. I have non-tech friends who (reasonably, imo) say they have not much use for it at all. Even many professionals outside of math&code are in this tier. For example, execs and many other functions spend a lot of their time talking to other people, so while they understand what is happening intellectually, it is still second-hand and a bit abstract.
- Now we get to professional use of frontier-grade LLMs in math&code. Somewhere around 20M people (0.2%) see first-hand that large, complex projects that used to take them weeks/months can now be completed by agents with a prompt. Building apps, copying apps, translating apps, decompiling apps from binaries... This has all happened very quickly and recently - less than 1 year ago, I was writing code manually by hand, typing memorized computer code commands into a code editor character by character, occasionally pressing Tab to autocomplete a little chunk of code.
- And finally we get to the ~5,000 people (~0.00006%) with access to frontier-grade systems internally. The external world has seen the preview. It looks like swarms of thousands of agents collaborating over weeks on software mega projects: minting zero days, running cyber attacks and defenses at machine speeds, discovering new science, advancing the frontier of mathematics. Things that would have taken top professionals in the industry years of work. Meanwhile, human review and comprehension are starting to fall behind. For example, people are still involved in the "archeology" of the OpenAI-HF incident from many months ago. Mathematicians may be poring over the 722 manuscripts on frontier mathematics for a while.

The funnel is driven by a combination of factors:
1. The impact scales with ambition, problem size, and horizon. A question with a paragraph answer barely stresses the system. You need a reservoir of big, difficult problems that you really care about. This aspect drives the consumer / professional dimension of the funnel.
2. The jaggedness of the system (which I have written about a lot separately). Capability peaks in domains that are digital, verifiable and economically valuable. This is because LLM capability emerges from reinforcement learning on verifiable rewards on a curated environment mixture driven by revenue potential. This aspect primarily drives the area (e.g. math&code) dimension of the funnel.
3. Access. Free-tier, paid-tier, internal.

So this is the weirdness of the moment. The general public has mostly not interacted with these systems. When they have, it looks like a derpy chatbot. The majority of professionals still see only a modest uplift. And a small sliver of professionals are experiencing the vertigo of the curve going vertical. And it is all happening at the same time.

[Keith Lawson @j_klawson]

@esrtweet @djberg96 Apple did it to create their office suite.

[Keith Lawson @j_klawson]

@HermesWatcher DeepSeek v4 pro through open router

[Keith Lawson @j_klawson]

True. I just didn't start with it. It was all Perl, CGI, Apache (w/ mod_perl) when I started.

I never touched PHP because I saw it as a downgrade from Perl and skipped right to Python. I ignored the whole new daily javascript framework/language trend as well. My use cases haven't been the same as a commercial web app developer though.

[Dave W Plummer @davepl1968]

C++ is faster than Rust until Rust programmers can prove otherwise. And I have just the venue!

For years, I've been hosting the GitHub Primes competition, where folks in nearly 100 different languages all implement a prime sieve by the same basic rules.

Right now, my C++ solution remains on top. And it's older than AI :-)

Rust actually wins on the "workload per core" metric if you sort by passes, but leans over in the 128-core test.

If you can make ANY of them faster, please do! It's all open source, so no point in ARGUING that you think Lanauage X should be faster... just make it happen!

Sponsored by https://t.co/ywPW2JpWOx, you can find the results at:
https://t.co/OWFCsAbCQh

[Keith Lawson @j_klawson]

@Saanvi_dhillon Password vaults

[Keith Lawson @j_klawson]

@Naaackers Is this not simply a symptom of the fact most use cases of Linux are headless and we use SSH can CLI? I’ve been managing Linux systems for 30 years and never needed a remote GUI.

[Keith Lawson @j_klawson]

In a recent issue of @AndrewYNg's newsletter he writes:

"A lot of AI risks, including cyber vulnerabilities and how to contain agents, are engineering problems to be solved. To be clear, these are hard engineering problems! But I find that a lot of the fear-mongering scenarios implicitly assume that we will make little or no progress on them."

As a cybersecurity professional this is frustrating to read. Highlighting real risks that agent swarms pose today is not fear mongering. The industry is consciously deciding to put autonomous offensive capabilities ahead of defensive. Let's solve the hard engineering problems on control, containment and defense before we continue to experiment with building autonomous exploit development and offensive techniques can we?

[Keith Lawson @j_klawson]

@jeffbullas As a first year doctorate student with agents heavily embedded into my research workflow I don’t feel I’m doing less effective research or learning. I feel it’s making me more productive by doing some of the time sucking administrative tasks to free me up for more important work.

[Keith Lawson @j_klawson]

@itsalicesoul I didn’t answer your question though. Have the agents code to well written specifications instructed to not deviate from the spec. Agentic code review with a different agent and automated deterministic security checks in the CICD pipeline.

[Keith Lawson @j_klawson]

In my experience the code that coding agents write today is more secure than a lot of developers would write. On a large project with a team of human developers how do you know your app is secure? All the vulnerabilities coding agents are fixing right now were created by human developers.

[Keith Lawson @j_klawson]

@HermesAgentTips DeepSeek pro for nearly everything upgrading to sonnet 5.5 for complex tasks. I don’t use Hermes for coding or debugging. My use case is an agentic research assistant.

[Keith Lawson @j_klawson]

@esrtweet Programmers didn’t handle it well at the beginning either. Some still aren���t.

[Keith Lawson @j_klawson]

A good comparison to me is “cloud” computing. Just because we can now run workloads on collocated infrastructure that’s abstracted away doesn’t mean there’s no value in understanding how the underlying servers and networks function.

Oh and learn how DNS works inside out!

[Thariq @trq212]

working at a higher level of abstraction has always required understanding the lower level ones, I don't think coding agents changes this

[Keith Lawson @j_klawson]

@RichardSSutton This is rather timely for me. I'm just writing my candidacy proposal and can cite Fernando's contributions to the topic. Thanks for your work Fernando and congratulations!

[Keith Lawson @j_klawson]

@vburojevic I use it as an academic research assistant. It helps me manage my reading list for my literature review and tasks for my doctorate work.