Speaker 1: Bloomberg Audio Studios, Podcasts, Radio News.
Speaker 2: Hello and welcome to another episode of the Odd Thoughts podcast.
Speaker 2: I'm Tracy Alloway.
Speaker 3: And I'm Jill. Why isn't thal Joe.
Speaker 2: You know I have some uh prepper tendencies. Yeah, slightly
Speaker 2: prepper tendencies, Prepper adjacent.
Speaker 4: I know you do, because my plan for when everything,
Speaker 4: when everything goes bad, is to bring my family over
Speaker 4: to your place.
Speaker 3: So I'm relying on you.
Speaker 2: Actually, that's fine. I actually figured that, and I've been
Speaker 2: building an extra store of supplies.
Speaker 4: I'm gonna like send you a whole list of things
Speaker 4: my kids like to eat and stuff like that, just
Speaker 4: so that we're already Yeah, okay.
Speaker 2: Well, one of the things I saw on a bunch
Speaker 2: of the prepper boards that I sometimes look at. I
Speaker 2: don't want people to think that I'm crazy about it,
Speaker 2: but I find it interesting. I find it interesting seeing
Speaker 2: how people's like insecurities manifest in physical stuff. But anyway,
Speaker 2: one of the things everyone was saying was you need
Speaker 2: to start taking cash out because of the situation in Iran,
Speaker 2: because we're all expecting a big cyber attack that's going
Speaker 2: to absolutely destroy the US financial infrastructure.
Speaker 4: By the way, if I told you my idea for
Speaker 4: a business, like I've looked at prepper meals, like prepared meals,
Speaker 4: and they all look terrible. They do like a slightly
Speaker 4: high end version for yuppies I think would be really good,
Speaker 4: like something they you know, like.
Speaker 2: Some nice I think it's a physical limitation on how
Speaker 2: good you can actually get, like dry food.
Speaker 4: Scientist can do a lot of things these days. Anyway,
Speaker 4: let's talk about the actual issue at hand. Yeah, well,
Speaker 4: are you taking cash out?
Speaker 2: I have it? I haven't yet. I'm relying on my
Speaker 2: store of gold and silver. That's right. But I think
Speaker 2: this raises a legitimate and actually very interesting topic, which
Speaker 2: is what do we know about Iran's cyber I guess facilities, skills,
Speaker 2: what could happen in those context? And then also everything
Speaker 2: that's going on with the world of AI, right like
Speaker 2: cyber securities, cyber hacking. It's changing really rapidly given this
Speaker 2: new technology.
Speaker 4: Totally, I mean also just within the context of the
Speaker 4: war itself, setting aside hypothetical doom scenarios. There's a really
Speaker 4: interesting report in the Financial Times about Israel having been
Speaker 4: able to hack into all of the traffic lights in Tehran,
Speaker 4: almost unbelievable and shocking, but there's already within the war
Speaker 4: itself or even over the last couple of years, there
Speaker 4: was the pager attack that Israel had executed, and so yeah,
Speaker 4: cyber is part of it. And the timing is wild
Speaker 4: here because speaking of AI, it was just on Friday.
Speaker 4: We're recording this March fifth. I'm not exactly sure the
Speaker 4: data is coming out, but a week ago basically there
Speaker 4: was the news the complete collapse of the Anthropic relationship
Speaker 4: with the Department of Defense or the Department of War.
Speaker 4: And so it's all in the mix right now, and
Speaker 4: how is AI actually going to change warfare? And one
Speaker 4: of the national security implications of AI and AI and hacking.
Speaker 4: There is a lot in this sort of mix that's
Speaker 4: all happening right now.
Speaker 2: Absolutely. The thing that really caught my eye was the
Speaker 2: story about a hacker using Claude to hack into like
Speaker 2: the Mexican government system. Did you see that?
Speaker 4: That was really interesting because it seemed like the hacker
Speaker 4: extracted a bunch of information from Claude itself. You know,
Speaker 4: I'm pretty sure you cannot go to claud code and say, like,
Speaker 4: I want to break into the Mexican government website helped me,
Speaker 4: like build this app.
Speaker 3: It won't do that.
Speaker 4: It's trained to avoid malicious uses. But people find a
Speaker 4: way to jail break down. People find a way to
Speaker 4: sort of extract information from the AI itself that has
Speaker 4: in its training and so forth. And there's been examples
Speaker 4: of leaks where you know, people upload data to the
Speaker 4: AI and somehow other people see it. Anyway, there's a
Speaker 4: lot here that we have to learn more about.
Speaker 2: We should talk about all of it, and we do,
Speaker 2: in fact have the perfect guest, someone who's been on
Speaker 2: the podcast before but it's been a while. We're going
Speaker 2: to be speaking with Matt Swish. He is the founder
Speaker 2: of ondb, which is a data infrastructure startup for agentiic AI.
Speaker 2: So honestly the perfect a legendary French hacker. I should
Speaker 2: have said that first. Matt, thank you so much for
Speaker 2: coming back on all lots.
Speaker 5: Thank you very much. It's been I think it's been
Speaker 5: worth four years.
Speaker 3: Yeah, I think it has been.
Speaker 2: The Last time we spoke to you, you were still
Speaker 2: in Dubai, and now you're coming to us from Sweden
Speaker 2: and a very Gustavian looking background over there.
Speaker 4: I think actually what we talked to is right after
Speaker 4: Russia's invasion of Ukraine. So I guess, yeah, wow, that
Speaker 4: has been almost every.
Speaker 2: Time there's a war, we call you Matt.
Speaker 4: But because war is so intermixed with cyber espionage, cybersecurity, hacking,
Speaker 4: and so forth, it's a natural natural time.
Speaker 2: So for the benefit of people who didn't listen to
Speaker 2: the episode four years ago, can you just give some
Speaker 2: context around who you actually are and your sort of
Speaker 2: history in the hacking community, including you know, shadow brokers
Speaker 2: and the Wannacrey era and all that stuff.
Speaker 5: So I've been in enterprise software for almost like twenty years,
Speaker 5: particularly cyber security, and my name appeared in a few
Speaker 5: of the different leaks because of various analysis that I've
Speaker 5: done of private information that was being leaked, but also
Speaker 5: a lot of attacks that happened that happened to target
Speaker 5: critical infrastructure over the last ten years. And last time
Speaker 5: we were on the podcast, one of the things we
Speaker 5: talked about is does cyber really matter once you enter
Speaker 5: into a kinetic war, which is exactly what's happening now.
Speaker 5: And the main takeaway was once you start using missiles,
Speaker 5: most of these cyber elements are not really relevant because
Speaker 5: you would use cyber mostly to gather information and intelligence
Speaker 5: to prepare an attack or to disorganize an enemy. You
Speaker 5: create confusion, but as we have seen now, you can
Speaker 5: use like drones that are like twenty thousand dollars and
Speaker 5: create more chaos that you would do with any sort
Speaker 5: of exploits.
Speaker 4: I like how you're introduced as a legendary hacker and
Speaker 4: then you're like, oh, I've been twenty years in enterprise software.
Speaker 3: I feel like this is like the uh, the wind
Speaker 3: of the premium.
Speaker 4: It's like, you know, the casual and then fancy a
Speaker 4: dress up hacker and the like twenty years in enterprise software.
Speaker 4: But this is a really interesting point that you made
Speaker 4: this idea between Okay, mostly it sounds like when people
Speaker 4: imagined cyber attacks, they imagine what Tracy talked about in
Speaker 4: the beginning. Suddenly the entire financial infrastructure, like I just
Speaker 4: come to a haul of people worried about or there's
Speaker 4: gonna be a blackout, et cetera. But in reality, or
Speaker 4: what we've seen so far, by and large, is that
Speaker 4: cyber in the context of war is still much more
Speaker 4: about data collection, espionage, and so forth, rather than these
Speaker 4: more like you know, the types of things you might
Speaker 4: see in a movie.
Speaker 5: Yeah, exactly. I mean over the last like ten fifteen years,
Speaker 5: we've seen some like attacks like cyber attacks against a
Speaker 5: critical infrastructure you run talking like Aramco around like twenty twelve.
Speaker 5: They were just mostly like using what we call a
Speaker 5: wiper that was like a malware that was erasing the
Speaker 5: hard drive of most of the machines. And then we
Speaker 5: obviously have the case of Stocksnet few years before, where
Speaker 5: it was a joint Israeli US operation against some of
Speaker 5: the nuclear centrals in Iran where some of the PLCs
Speaker 5: were targeted. But what we have seen over the weekend
Speaker 5: is some of the drones happened to target some of
Speaker 5: the Amazon data centers and that created so much instability
Speaker 5: because multiple of the zones have been down and I
Speaker 5: think two out of three and the third one is
Speaker 5: still recovering days after. Because most of companies, either private
Speaker 5: companies or public companies not relying on the cloud, which
Speaker 5: is something that was not really the case before, and
Speaker 5: once you have some softw of centralization in terms of dependence,
Speaker 5: so become an easy target. And most of government's AI companies,
Speaker 5: cloud companies do not really have twenty thousand dollars drones
Speaker 5: in their threat models, which is like something that's pretty new,
Speaker 5: but also confirms that Kinneti quals and have more impact.
Speaker 2: So I take the point about cyber being perhaps more
Speaker 2: useful before a war when it comes to info gathering
Speaker 2: and things like that. But we have seen some deployment
Speaker 2: of cyber attacks in the past week or so. So
Speaker 2: we know Israel is attacking some cyber infrastructure in Iran,
Speaker 2: and we know that Iran has perhaps attempted some things,
Speaker 2: maybe not as successfully, but walk us through what we've
Speaker 2: actually seen so far.
Speaker 5: So so far, we have seen an Israeli operation where
Speaker 5: one of the prayer app has been hijacked and so
Speaker 5: message was sent to the users, so it's more like
Speaker 5: to create confusion within people. Also the traffic Light operation
Speaker 5: to understand the position of some of the targets, but
Speaker 5: it's more used for like recaoning a In terms of destruction,
Speaker 5: we didn't see anything significant. Even the government itself of
Speaker 5: Iran shut down most of the Internet for a lot
Speaker 5: of the users, and a lot of what we see
Speaker 5: on social media is the usual disinformation and misinformation campaign,
Speaker 5: especially now with AI. There is so much AI slob
Speaker 5: with like the videos, the text, the boats. That's becoming
Speaker 5: pretty common now, even when there is no war, So
Speaker 5: it's not really like really impactful. So it's more like
Speaker 5: to create confusion than being actually destructive. And now we're
Speaker 5: differently entering in a stage where it's been extremely destructive.
Speaker 5: And I cannot remember the last time we've seen so
Speaker 5: many countries being targeted, which is pretty like a first
Speaker 5: I would say, in terms of like a war climate.
Speaker 4: Can you talk about You know, people stare at their
Speaker 4: screens all day, and they fool themselves into thinking that
Speaker 4: they're quote monitoring the situation, et cetera, but mostly.
Speaker 6: The projections here.
Speaker 4: I don't delude myself, no, I like, actually like I
Speaker 4: sort of look at my screen and I know that
Speaker 4: I'm being inundated with contextless garbage and slop and propaganda
Speaker 4: and so forth. I'm curious how you monitor the situation actually,
Speaker 4: as someone who takes these topics seriously and doesn't just
Speaker 4: sort of become an overnight expert, you know, the day
Speaker 4: after bombings begin, Like how do you pay attention to
Speaker 4: what matters? How do you actually know what's real and
Speaker 4: so forth, and avoid just sort of the delusion of
Speaker 4: staring at the screen and engaging with slop.
Speaker 5: It's a good question because there's so much of it,
Speaker 5: so I think the default reaction is to ignore most
Speaker 5: of it, Yeah, unless it becomes really significant. In this case,
Speaker 5: I think it comes down to looking at the actual damage.
Speaker 5: Many people from the military world, but also the intelligence
Speaker 5: community has been underestimating Iran capabilities exactly like people used
Speaker 5: to do with North Korea, and now North koreas some
Speaker 5: of the best hackers in the world when we see
Speaker 5: them like targeting financial institutions, whereas before they would not
Speaker 5: do like much. So there is definitely like internal capabilities
Speaker 5: that are available, but there's so much noise now, Like
Speaker 5: you say, a lot of people are monitoring the situation
Speaker 5: giving that quote un quote like overnight expert opinions, and
Speaker 5: that's becoming a lot of noise. But I would say
Speaker 5: that in this particular case, we have heard of the
Speaker 5: imminent threat of Iran for around forty years, and that's
Speaker 5: also not really a new situation, so most of people
Speaker 5: would have context around it. And even for the attack
Speaker 5: that happened last week, and many people were expecting them
Speaker 5: four weeks, especially as the continuation of what happened last summer.
Speaker 4: Can you actually talk a little bit more about the
Speaker 4: data center attack? And because that's not cider really, I
Speaker 4: mean that's that's just a physical kinetic warfare against the
Speaker 4: data center. I was surprised how disruptive was that. I
Speaker 4: sort of would assume that cloud service providers that it's
Speaker 4: fairly liquid. Okay, one goes down, but you know, it
Speaker 4: can just be the same software, it can be run
Speaker 4: from numerous other clouds. But I saw that there were disruptions.
Speaker 4: I saw Fortnite tweeting about the fact that some of
Speaker 4: their gameplay was impaired due to the attack on data centers.
Speaker 4: How disruptive have those attacks been? Because this is of
Speaker 4: course a very.
Speaker 2: You know, that's whereinetic meatia.
Speaker 4: Yeah, yeah, and there's a lot you know in the future,
Speaker 4: like thinking about hardening these data centers and as you say,
Speaker 4: like making them they're going to be increasingly targets for war.
Speaker 4: Like how disruptive was that?
Speaker 5: Very good question? So I think one of the main
Speaker 5: takeaway is that it has been extremely successful. So, like
Speaker 5: we said before, like a Shahid drone is around twenty
Speaker 5: thousand dollars and they managed to shut down two of
Speaker 5: the zones of Amazon. Actually, even if you look at
Speaker 5: the official report from Amazon for like thirty six hours,
Speaker 5: they were just saying, oh, some objects struck the data
Speaker 5: centers before they actually expletely said they were drawn strikes.
Speaker 5: So a lot of services that I've been using them
Speaker 5: have been targeted, so from like local applications from two
Speaker 5: banks because in a data center you are taking care
Speaker 5: of multiple different services, and even Versail had to reroute
Speaker 5: their data to Bombay and to exclude middle List as deployment.
Speaker 5: So even if you take the cost of most of
Speaker 5: like zero, the exploits that can go up to like
Speaker 5: multimillion dollar attacks. If you are really aiming at districting things,
Speaker 5: the cost reward of using such an attack is really efficient.
Speaker 5: So you really enter into some sort of asymmetric conflict
Speaker 5: where you can just spend like some really old material
Speaker 5: and have way more impact than someone who's going to
Speaker 5: be like cutting edge and just trying to impress with
Speaker 5: like capabilities. Because at the end of the day, it
Speaker 5: does not really matter.
Speaker 2: How do governments actually build up their cyber capabilities nowadays,
Speaker 2: Because I have this image in my head of maybe
Speaker 2: ten or twenty years ago, you know, they would recruit
Speaker 2: like a twenty year old such as yourself at the time,
Speaker 2: and they would be working in a dark room, that
Speaker 2: sort of thing, but then drinking red bull. Drinking red bull,
Speaker 2: that's right. But then you know, we had the boom
Speaker 2: in Silicon Valley and so you had competition from private companies.
Speaker 2: Now we have the boom in AI and again even
Speaker 2: more competition from private companies. And at the same time,
Speaker 2: governments seem to be I guess, seeding some of their
Speaker 2: own skill set to potentially private companies like Anthropic and
Speaker 2: chat GPT and some others. Walk us through how I
Speaker 2: guess the development of governmental cyber capacity has actually shifted.
Speaker 5: I mean something that didn't really change over the last
Speaker 5: years in terms of capabilities, Like I guess we all
Speaker 5: remember like these snodnnicks in twenty thirteen when we started
Speaker 5: to see more about the inside of capabilities from a government,
Speaker 5: including like domestic my surveillance, global surveillance, exploitation capabilities, And
Speaker 5: since then every other year we have seen an history
Speaker 5: of data being leaked that belongs to the government. So
Speaker 5: in a way, things have been changing a lot, but
Speaker 5: not really much. Like most recently, there was a contractor
Speaker 5: from n Free Iris that was sentenced to eighty seven
Speaker 5: months sentence because they happened to sell zero the exploits
Speaker 5: to a Russian broker, and that's actual expert that belonged
Speaker 5: to the government because there was some sort of integrator.
Speaker 5: So we see like nation states or like governments like
Speaker 5: the US investing like an almost amount of money into
Speaker 5: offensive capabilities, but they also keep being burned by insiders.
Speaker 5: A lot of those capabilities are also as strong as the
Speaker 5: internal coercion.
Speaker 2: But I guess what I'm asking is, you know, if
Speaker 2: you're the Department of Defense or I guess now the
Speaker 2: Department of War, and you're thinking about developing in house
Speaker 2: capabilities versus partnering with a company like Anthropic, and we
Speaker 2: should talk about all the drama that's going on there,
Speaker 2: how are you balancing those decisions nowadays versus say, ten
Speaker 2: or twenty years ago.
Speaker 5: Like my understanding is that now a lot of it
Speaker 5: is also like outsourced because they cannot really develop as
Speaker 5: many capabilities internally. So now like we have seen with
Speaker 5: Entropic that it had been used in the Maduro operation
Speaker 5: and then after that, like there was a per out
Speaker 5: from Entropic because they said it was violating their ethical
Speaker 5: like standard like policy, Yeah, standards. So I would say, now,
Speaker 5: something that's really changing like very fast is the incorporation
Speaker 5: of like AI into tho's decisions. But as we all know,
Speaker 5: like AI can also hallucinate, so even Darly or the
Speaker 5: CEO of Entropics that it's definitely not in a state
Speaker 5: where it can be used for like fully autonomous decisions
Speaker 5: like that. So I would say, like the AI element
Speaker 5: would be like the main difference even we start to
Speaker 5: see it now for like exploit development or vulnerability discovery,
Speaker 5: but it's still too early to kind of like give
Speaker 5: a definitive like opinion about it. But overall, I would
Speaker 5: say it's very similar.
Speaker 4: Well, talk to us about exploit development, because I know
Speaker 4: that you can't just go to cloud code and say, like,
Speaker 4: I'm working on zero day mailware attack, help me figure
Speaker 4: this out. But you know, I also know that there
Speaker 4: are some very talented people who pride themselves in being
Speaker 4: able to jail break AI and illicit outputs that the
Speaker 4: labs do not want their AIS to produce. So do
Speaker 4: you have a sense how just within the pure like
Speaker 4: hacker community, AI is being employed today for these purposes
Speaker 4: or what they're able to get out of these tools.
Speaker 5: It's a good question. So, like we started to see
Speaker 5: people leveraging like AI for like bug discovery, which actually
Speaker 5: is becoming like pretty good. I think even Entropy published
Speaker 5: an article explaining how cloud can be used for the
Speaker 5: discovery into smart contracts and how it found some bugs automatically.
Speaker 5: And I think even recently there really is something called
Speaker 5: cloud for security that was aiming at doing cod assessment.
Speaker 5: But now we're entering in is like interesting paradigm shift
Speaker 5: where the cost of software is going towards zero. So
Speaker 5: if you're a company and if your cost of building
Speaker 5: software is becoming less and less, it's also hard to
Speaker 5: convince people that auditing software for security reasons is going
Speaker 5: to be more expensive than developing the actual software. So
Speaker 5: I think that's one of those shifts we're going to see.
Speaker 4: But when can you explain positive lives Mark, what did
Speaker 4: you mean by that? It's going to be hard to convent.
Speaker 5: If you can have like to allocate budgets for building
Speaker 5: a product, So you have most of the budget that's
Speaker 5: usually allocated for like your software engineers to build the software,
Speaker 5: and then you do some code review afterwards to make
Speaker 5: sure there's no vulnerabilities before it gets released to the public,
Speaker 5: but securities risk is usually like pretty high. You cannot
Speaker 5: just rely on like EI tools, at least not at
Speaker 5: the moment. Maybe in a year from now it's going
Speaker 5: to be possible. So it's going to be like really
Speaker 5: interesting to see how it's going to like do like
Speaker 5: a market shift because now with cloud code, and as
Speaker 5: a famous Vibe coder, Joe, I'm sure you know that
Speaker 5: the cost of building software is approaching like zero if
Speaker 5: you just look on the timeline.
Speaker 2: Are you actually on this note, are you a believer
Speaker 2: in the SaaS apocalypse? Because obviously there's the argument that, well,
Speaker 2: now everyone can just create their own software fairly easily
Speaker 2: using natural language. But on the other hand, if you
Speaker 2: are a big corporation or presumably a government you're going
Speaker 2: to want to have you're going to still want to
Speaker 2: buy software from an external provider given some of the
Speaker 2: security concerns, given that it might not necessarily make sense
Speaker 2: for various reasons, management reasons, perhaps recreate an entire software
Speaker 2: business in house.
Speaker 5: So I'm definitely biased on that. But as someone who
Speaker 5: thinks that the cost of software is going towards zero,
Speaker 5: and as someone who is like watching the software costs
Speaker 5: like collapsing. One of the things that we realize is
Speaker 5: that data is the only durabel asset in the AI economy.
Speaker 5: That's why we decided to work on the bid the
Speaker 5: current startup I'm working on, because like that's the only
Speaker 5: thing that's really going to have value long term if
Speaker 5: agents need something to transact or like to take the decision.
Speaker 5: Because even if you look in terms of like in
Speaker 5: any context, you know, if agents are designed to think autonomously,
Speaker 5: you need to have enough information to take those decisions
Speaker 5: whenever you're going to have your reasoning loops. So software itself,
Speaker 5: if you just build it, is pretty static, whereas like
Speaker 5: the urgentic like feedback loops are more dynamic. But what
Speaker 5: changes the contexts that take decision on. So definitely, like
Speaker 5: Salz business are going to have our time because if anyone,
Speaker 5: including the Shopify CEO, can just rewrite an MRI software
Speaker 5: in one afternoon just to like look at his back MRIs,
Speaker 5: you can imagine like how destructive it's going to be,
Speaker 5: like by the end of this year. I think the
Speaker 5: only thing we haven't seen yet is like enterprise AI agent.
Speaker 5: So so far I would say, like since Christmas, people
Speaker 5: are most still playing around trying to find like a
Speaker 5: proper use case. We see a lot of like consumer
Speaker 5: like AI agent like open Cloth that really met like
Speaker 5: agents more mainstream, but we really haven't seen yet enterprise
Speaker 5: AI agent. So as everyone is kind of scared of
Speaker 5: being replaced for their jobs, we haven't really seen in
Speaker 5: like actual like AI agents replacing entire departments or full
Speaker 5: on like employees. So we have seen some disruption around
Speaker 5: like software engineering, mostly to make like software engineering more efficient,
Speaker 5: especially in terms of like development with shorter timelines, but
Speaker 5: we haven't seen yet like proper like enterprise agents.
Speaker 3: How do you define an AI agent?
Speaker 5: So my view of an AI agent and I like
Speaker 5: to remind people like what an AI agent actually is.
Speaker 5: At the moment, most of AI agent is just like
Speaker 5: a piece of God usually written in Python or in
Speaker 5: type script. That's just doing a bunch of cards to
Speaker 5: like entropic PENAI and running in a loop and taking
Speaker 5: decisions and calling like third party tools like MCPS or
Speaker 5: web searches. So that's mostly what an AI agent is.
Speaker 5: We tend to think of AI agent as a completely
Speaker 5: different persona. But at the end of the day. It
Speaker 5: is just like a piece of software that's running as
Speaker 5: a service on a machine or on a server. So
Speaker 5: from a security standpoint, which is pretty interesting, it's just
Speaker 5: like another service. So like software, but people really like
Speaker 5: to think of it in another way.
Speaker 4: Well, just so like I'm from the security standpoint, I mean,
Speaker 4: one of the exciting aspects of AI agents is that
Speaker 4: they can work autonomously. Right, you set a task and
Speaker 4: it can go out and find what it needs to do,
Speaker 4: and it says like, Okay, this didn't work, I'm gonna
Speaker 4: try it's gonna try this thing. It's gonna try this thing.
Speaker 4: I need to connect to this web service to get
Speaker 4: this information, et cetera. The downside of AI agents is
Speaker 4: precisely the same. The downside of AI agent says that
Speaker 4: they could do whatever they want to do and if
Speaker 4: it accidentally deletes a bunch of files because it thinks
Speaker 4: that's what's necessary to execute the task.
Speaker 3: So like I'm curious, Like from a security.
Speaker 4: Standpoint, like I mean, we've already seen examples of people
Speaker 4: getting private information exposed or as I mentioned, and the
Speaker 4: example of deleting a bunch of information. Is this like
Speaker 4: a new way to think about the security threat model.
Speaker 4: The fact that the capability and the downside are one
Speaker 4: and the same.
Speaker 3: It's the same.
Speaker 4: It's sort of like hallucinations, right, the ability to like
Speaker 4: create an output, and it also you know, is hand
Speaker 4: in hand with the ability to create a wrong output,
Speaker 4: a false output, and so you know, the ability to
Speaker 4: do to act on its own is also the ability
Speaker 4: to destroy on its own. Is this sort of like
Speaker 4: a novel threat model or a novel paradigm in thinking
Speaker 4: about enterprise security.
Speaker 5: From an enterprise security standpoint, it is pretty much the
Speaker 5: same thing in the sense of like if you're building software,
Speaker 5: you can just really like patch software afterwards and stuff,
Speaker 5: because you never it never ends. Like secrety might be
Speaker 5: like built in, and you need to have like a
Speaker 5: safe design from the beginning. What we have seen now
Speaker 5: is like whenever people do something argenttic, they just give
Speaker 5: like all permeisterns up from yeah, which is like probably
Speaker 5: the worst thing you can do. And if you're an enterprise,
Speaker 5: as you can imagine, if you just give like all
Speaker 5: permissions to an agent, it just becomes Murphy's Lows. If
Speaker 5: something bad can happen because you give it access to
Speaker 5: it will happen. So you're going to see like more
Speaker 5: dataks for sure, because there's no safety by design in
Speaker 5: those like architectures or like those like agents, which is
Speaker 5: in terms of reliabilities and like exposure would be like
Speaker 5: very similar to what we have seen over the last
Speaker 5: like ten twenty years. But you know, if people are
Speaker 5: ignoring what has been done in terms of software security
Speaker 5: for the last twenty years, that's why we're going to
Speaker 5: have a lot of problems. And I think we're probably
Speaker 5: going to start to see like people, especially in enterprise,
Speaker 5: like pushing back a lot because there's compliance that needs
Speaker 5: to be like, you know, like answer to, so you
Speaker 5: cannot just give like full access to like you know,
Speaker 5: your agent.
Speaker 2: Speaking of the long arc of history, one thing I
Speaker 2: really wonder is you've obviously been in this space for
Speaker 2: a very long time at this point. Can you describe
Speaker 2: how you think your own career and I guess coding
Speaker 2: experience would have been different if you were, say, starting
Speaker 2: out now in twenty twenty six versus I guess you
Speaker 2: would have started out in like the late nineties or
Speaker 2: early two thousands, maybe even before that, yeah.
Speaker 5: Mid two thousands. Well, I would say, like, what has
Speaker 5: changed is back even like we even we've up going
Speaker 5: to like the two thousands, Like back in the snow
Speaker 5: and days when the global surveillance program was being exposed,
Speaker 5: like a lot of people were really like scared of
Speaker 5: it and scandalized by it and push back and people
Speaker 5: really cared about privacy was like now we're entering in
Speaker 5: a new arc where very few people care about privacy.
Speaker 5: Where you see like the CEO of Entropy being asked
Speaker 5: why he refused to work with the US government and
Speaker 5: he says, well, they wanted to do a domestic surveillance program,
Speaker 5: so that's against or like a safety like chart. So
Speaker 5: there's this all aspect of people relationship with data, which
Speaker 5: I guess is very different in terms of software off
Speaker 5: you see like now you can write more things, anyone
Speaker 5: can write anything. But I think we're still in this
Speaker 5: weird adequate software phase where we know what AI can do,
Speaker 5: but it cannot really do anything more or anything less.
Speaker 5: Yet you haven't seen like the actually or like use
Speaker 5: cass for it. Because it's obviously like very exciting and
Speaker 5: it feels like a lot of it is very different
Speaker 5: from before, but we don't really have like any evidence
Speaker 5: of how it's really helping in national security. I know
Speaker 5: it's been helping people who have been analyzing like Epstein's
Speaker 5: emails because there's a lot of data and that makes
Speaker 5: it faster. But in terms of like real use case,
Speaker 5: I don't think like it feels like the current world
Speaker 5: is very different than before, but there's so much noise
Speaker 5: and so much like slop all over that in a
Speaker 5: way it is pretty similar. I don't know if that
Speaker 5: makes sense.
Speaker 4: Well, I mean does your company is o n dB
Speaker 4: dot AI, So you must think that it's going to
Speaker 4: be used or they you know, or that there's clearly
Speaker 4: something there actually tell us about I'm actually really I'm
Speaker 4: on your website right now. It looks really interesting because
Speaker 4: it's something I've been thinking about. But you must have
Speaker 4: some vision for like where it's going and that there
Speaker 4: will actually be significant demand for these services.
Speaker 5: Sure. I mean, like I was saying, like I think
Speaker 5: now we've like anything that's urgentic building software, which is
Speaker 5: like the main use case so far for AI is
Speaker 5: going to make software like going to zero, so the
Speaker 5: cost of building software is going to.
Speaker 3: So that's real.
Speaker 4: So like say, like there's in your view, there's no
Speaker 4: question that already AI. I mean talk about use it's
Speaker 4: a pretty big use case right there, bringing the cost
Speaker 4: of building software to zero.
Speaker 5: Yeah, I mean, like even if you look at the
Speaker 5: offer of cloud code, he said that you didn't write
Speaker 5: like cod since November, So like a lot of people
Speaker 5: are like this, you know, even us internally, like we
Speaker 5: definitely like use cloud code a lot. But if software
Speaker 5: is going to zero, like what's left in terms of
Speaker 5: like the internet layers. So our conclusion is that data
Speaker 5: is the only thing that's going to be like timeless
Speaker 5: in the AI economy, so building like a layer for that.
Speaker 5: Especially now there's like all those innovations around like payments
Speaker 5: and stable coin that you can use to actually like
Speaker 5: pay like anything online. So we think like, okay, if
Speaker 5: you have like issues like entropy or like opening I
Speaker 5: just scrapping Internet and using like public internet, so you
Speaker 5: may as well find ways of charging like boats or
Speaker 5: agent for your data. So at least you can have
Speaker 5: this new like revenue unlock that's going to emerge in
Speaker 5: these new economy because I think a lot of the
Speaker 5: traditional like economic model, like for instance, like we said
Speaker 5: like with SaaS are going to be like disrupted a lot.
Speaker 5: So there is a completely new market around help people
Speaker 5: are going to consume data, and I think people would
Speaker 5: just be ready to pay like more to have eigh
Speaker 5: quality data because the more noise there is, the more
Speaker 5: you want to make sure that the data access to
Speaker 5: is going to be like valuable and real. So yeah,
Speaker 5: even from a security standpoint, you know, like once you
Speaker 5: build like an infrastecure layer, you can have these like
Speaker 5: built in security to make sure that the data you
Speaker 5: give back or the access like for the interface that
Speaker 5: you define is actually secure. Because even if you look
Speaker 5: at Opencloth for instance, one of the top skill was malware.
Speaker 5: So like people just like living into like wild West,
Speaker 5: but they just run everything. So it's us anticipating that
Speaker 5: enterprise is going to look very different and they won't
Speaker 5: just run like anything they find online.
Speaker 4: Yeah, you know, this is one of the things that
Speaker 4: I've encountered in my Vibe coding for is is that
Speaker 4: one of the annoying things is Okay, you want the
Speaker 4: agent to like go out and grab some information or
Speaker 4: clear some database or whatever, and then it's like okay,
Speaker 4: like let me know when you've gotten an API, They're
Speaker 4: like okay, come back and get and then you have
Speaker 4: to go to a website, and then you have to
Speaker 4: get out your credit card and you have to set
Speaker 4: up an account, and then you get an API key
Speaker 4: and then you copy and paste it and so forth,
Speaker 4: and that's very annoying.
Speaker 3: I want.
Speaker 4: What I want is for the agent to just be
Speaker 4: able to go there say, oh, you know, like let
Speaker 4: me just pay you with some stable coins, et cetera.
Speaker 4: Just go out and get the information on its own
Speaker 4: without having this human in the loop. But it also
Speaker 4: occurs to me, and this is something that I've asked
Speaker 4: about with others, which is that like, once I'm just
Speaker 4: like entirely operating in the terminal and the agent just
Speaker 4: going out and scraping information for me, et cetera. Like
Speaker 4: why do we even have a free public internet anymore?
Speaker 4: And so like I'm curious, like whether the direction of
Speaker 4: the Internet and information in general is just entirely like
Speaker 4: you know, paying micro transaction or fees for data consumption
Speaker 4: so that the data then arrives in some usable form
Speaker 4: in the terminal that I'm operating.
Speaker 5: Yeah, no, I think you're You're raising some really good points.
Speaker 5: We need to talk after you can be design.
Speaker 3: You know, it's going to hack the ati I can be,
Speaker 3: I can be a consultant.
Speaker 4: No I hate having to deal with all these API
Speaker 4: key is why am I still using?
Speaker 5: You're like completely right, Yeah, I told you're famous code.
Speaker 5: It's like but like the US case, you're describing noise
Speaker 5: like it makes entire sense. That's why, like we position
Speaker 5: ourselves kind of like as a trusted like provider, where
Speaker 5: like instead of having to go like everywhere to get data,
Speaker 5: you know, you have like this single point and unified
Speaker 5: access a bit like open Router for AI models, but
Speaker 5: for provids. Because if you think about it, when you
Speaker 5: use like cloud now in your terminal, like the level
Speaker 5: one is basically you asking the model itself for information,
Speaker 5: but as we know, like the model maybe like a
Speaker 5: few months old and doesn't have access to the information.
Speaker 5: So like the second level is the agent like cloud
Speaker 5: god or a cloud for this top or like cha
Speaker 5: gip doing web searches, and that's just them looking on
Speaker 5: the internet doing like Google search, etc. But that's still
Speaker 5: not giving you access to like the actual relevant data
Speaker 5: that you would need, where for instance, you would have
Speaker 5: like those APIs and stuff. So like the level after
Speaker 5: that is basically access to private information. So on private information,
Speaker 5: usually the one that's valuable, like in the case of Bloomberg,
Speaker 5: for instance, Bloomberg has a lot of extremely valuable information,
Speaker 5: but you can only have access to it through the
Speaker 5: terminal once you have the subscription, or like any SaaS
Speaker 5: services if you think of like SaaS platform at just
Speaker 5: like some fancy UI where you can like browser database,
Speaker 5: but the data that's valuable is just in the database directly.
Speaker 5: So if you have access to those APIs and we
Speaker 5: not have to create like one million subscriptions left and right,
Speaker 5: because there's already like someone who's doing the integration for
Speaker 5: that kind of like as a programmatic like API marketplace.
Speaker 5: But the integration now is like much easier, and especially
Speaker 5: if you trust it because now what we have seen
Speaker 5: or so it's like whenever use autos tools, they make
Speaker 5: you install like MCPS, but more and more people are
Speaker 5: like moving away from mcps, they're just using like skills
Speaker 5: because like you just said, we start to spend more
Speaker 5: time into the terminal. So like the terminal and anything
Speaker 5: that cila is becoming like a natural interface for like
Speaker 5: agents even for humans because you don't need to try
Speaker 5: to understand those like fancy UI and ux, you just say, like, Okay,
Speaker 5: I want to do it, ABC just do that. So
Speaker 5: I think it just makes more sense to have like
Speaker 5: this interface for it, and like, like you said, you know,
Speaker 5: like otherwise it's just like it becomes too complicated.
Speaker 2: Just on this note, can we talk a little bit
Speaker 2: about I guess institutional knowledge of code because I remember
Speaker 2: one of the things that happened in the early days
Speaker 2: of AI development. I mean not that early. I think
Speaker 2: it was like twenty seventeen or something, back when Facebook's
Speaker 2: AI lab still existed. What was that called again, Like
Speaker 2: the acronym was fair or something. Yeah, they had like
Speaker 2: a little Facebook like experimental lab. Anyway, they invented a
Speaker 2: bunch of chatbots, and the chatbots started talking to each
Speaker 2: other in pretty much incomprehensible language, but like they clearly
Speaker 2: understood what each other were saying. And so I'm just
Speaker 2: wondering if you extrapolate that to AI generated code, could
Speaker 2: we have a situation where the models are constantly iterating
Speaker 2: on themselves, They're constantly talking to each other, and so
Speaker 2: we end up with a system that becomes very very
Speaker 2: difficult for human engineers and coders to actually understand.
Speaker 5: Yeah, I mean I think what we're gonna stop to
Speaker 5: is like humans, you know, like us are going to
Speaker 5: move towards like creating like margdon files as like a
Speaker 5: programming language. So everything is just going to be like
Speaker 5: normal like language, but for the machine itself obviously. Yeah,
Speaker 5: I remember that video that is like gibberish like voice
Speaker 5: transfer thing. Well, if you think about it, it's not
Speaker 5: that much different from voice to text in that sense.
Speaker 5: And at the end of the day, just like bits
Speaker 5: like being transferred. Because even like whenever you connect on
Speaker 5: a web page, you know, like you write it in text,
Speaker 5: but behind it just like bites that being a change.
Speaker 5: So agents still need to agree on the protocol that
Speaker 5: they're going to use, and not necessarily an encryption format,
Speaker 5: but an encoding format. So once you know what it is,
Speaker 5: you know, it just becomes like like a reverse engineering
Speaker 5: problem or like a foreign sake problem where you're just like, okay,
Speaker 5: like this is what's being used when THOSS packets are
Speaker 5: being sent. You know, let me just decrypt it once
Speaker 5: you know the protocol, you know. Like that's so I
Speaker 5: don't think we're going to end up in a situation
Speaker 5: where like we would have like no idea of it,
Speaker 5: because you're always going to have like people who are
Speaker 5: like pretty good like reverse engineers. But at the same time,
Speaker 5: you're also going to have like aah assistant who's going
Speaker 5: to help you to like reverse engineer those things. So
Speaker 5: in a way, even if it happens like you are
Speaker 5: not like alone with your red bull and you I
Speaker 5: know AI agents, we're all gonna have AI agents. So
Speaker 5: that's also like the reality of things. So we're far
Speaker 5: from just like the Clippy plugin that we used to
Speaker 5: have in Microsoft Office, or you can have this like
Speaker 5: CLI interface. We just give like commands and then it's
Speaker 5: led that into like Okay, I understand what I need
Speaker 5: to do, you know, and that's it. No.
Speaker 4: I love like interacting with just the CLI now, And
Speaker 4: like every time I have to go to the web,
Speaker 4: it feels like some sort of failure. I'm like, I
Speaker 4: have to go to this brace website, yeah, and I
Speaker 4: just like want the information right there on the black
Speaker 4: screen talking, you know, communicating back and forth in English background.
Speaker 5: You know, that's like feeling familiar for you.
Speaker 3: You know.
Speaker 4: Something I think about is I imagine that there's a lot
Speaker 4: of like crusty old Linux and Unix programmers who are like, oh,
Speaker 4: this code is this isn't high quality code that the
Speaker 4: AI that the chat pods produced.
Speaker 3: This is slop code. It needs all.
Speaker 4: Kinds of fixing and so forth. From your perspective, is
Speaker 4: the code itself of good quality or of improving quality?
Speaker 4: How just the lines of code itself from your standards
Speaker 4: is a good stuff?
Speaker 5: Yeah, it's pretty good then even when it's bad. You
Speaker 5: just said it okay, like this is bad. You know,
Speaker 5: like just do it better. You know, like if you're
Speaker 5: using like negative rewards, you know, if you say okay,
Speaker 5: like this piece of code is garbage, you know it's
Speaker 5: gonna understand better because you kind of give like a
Speaker 5: strong emotion where it's like if you say, oh it's okay,
Speaker 5: you know it's be like okay, like whatever. You know,
Speaker 5: if it's okay, it means it's passing, like the the
Speaker 5: Eddequo test. Okay, that's their badge. You write it.
Speaker 2: And I always do this so if I ask about
Speaker 2: for something, I will always say, like after the first version,
Speaker 2: like do better and just see what it comes up with,
Speaker 2: and just try to iterate this is.
Speaker 4: This is tough because you're talking when you're talking in
Speaker 4: English the brain deludes itself into thinking that you're talking
Speaker 4: to or when you're talking in human language, any language,
Speaker 4: the brain deludes itself you feel like you're talking to
Speaker 4: a person, so you have to be nice.
Speaker 2: Well, then I feel like I don't have that problem.
Speaker 4: But then I feel like I like I don't want
Speaker 4: to say, oh, this is garbage. I don't But from
Speaker 4: your perspective, it's actually sort of important to to be
Speaker 4: firm with the bot, and you get better results by
Speaker 4: being more sharp with it.
Speaker 5: Yeah, because it's the equivalent to the negative world. Like
Speaker 5: just like positive world. If you if it does something,
Speaker 5: you say, okay, like that's great, that's exactly what I
Speaker 5: tried to explain. Then it's like okay, like that's like
Speaker 5: a reference point. Was Like if it starts to go
Speaker 5: on a tangent, you just say like, oh, that's completely
Speaker 5: like out of the line, redo this, like why are
Speaker 5: you doing this? You know, like the more explicit you are,
Speaker 5: the better it's going to understand how far these from
Speaker 5: the requirements.
Speaker 4: Well, I just have to get better, you know, sort
Speaker 4: of conflict avoidant, and I like very nice to people.
Speaker 2: So I just still says please and thank you. So
Speaker 2: I just bask doesn't get them.
Speaker 3: So yeah, that's right.
Speaker 4: So I have to I just have to be like, no,
Speaker 4: this is trash, this is garbage. You totally we're all
Speaker 4: dumber for having seen this code. Okay, this is good
Speaker 4: to know.
Speaker 5: I mean it's a good point. You know, like those
Speaker 5: like AI companies that are recording all the prompts, you know, yeah,
Speaker 5: if they're keeping it, if there's retention around it, you know,
Speaker 5: like we know the open the eye is keeping them,
Speaker 5: you know, like they can get sophy. Is so your
Speaker 5: importance it? Yeah, so like who knows, you know, like
Speaker 5: in years from now, if there's like full on like
Speaker 5: autonomous like robots managed by the Department of War because
Speaker 5: they think it's lowful so.
Speaker 7: We all get social scores based on our Yeah, these
Speaker 7: thoughts creep into my head on ironically where it's like
Speaker 7: at some point is there's going to be some am
Speaker 7: I going to regret having?
Speaker 3: I don't know? They I they were there in my head.
Speaker 2: Truly a brave new world, Matt. Just one last question
Speaker 2: for me, but going back to cybersecurity and the current
Speaker 2: situation with Iran, what are you on just the lookout for,
Speaker 2: like what would peak your interest the most to see
Speaker 2: in that particular space.
Speaker 5: I think now in that particular space because I'm one
Speaker 5: of those people who think it's related to the Epstein files,
Speaker 5: you know, like it's just more about like getting more
Speaker 5: Epstein Files related stuff to see if there is like
Speaker 5: more connections to it, you know. So I think that
Speaker 5: would be the only thing that would kind of be
Speaker 5: like digital that we like spike my interest because now
Speaker 5: we have seen you know, like just those like all
Speaker 5: drones can do like so much damage, and that Iran
Speaker 5: demonstrated that they can be like really precise with the attacks.
Speaker 5: So now I think it's more about seeing like which
Speaker 5: direction it's going to go to and how long it's
Speaker 5: going to last, which is like the big question mark
Speaker 5: because there's so many other components, like the energy sector,
Speaker 5: you know, like how is it We have seen the
Speaker 5: price of like memory like increasing like a lot. So
Speaker 5: now now if they're starting to block like the Detroit
Speaker 5: of almost you know, like like what's gonna happen to
Speaker 5: like the cost of data centers and like memory and
Speaker 5: AI in general. You know, like we're going towards on
Speaker 5: one side, you know, we're going towards like the cost
Speaker 5: of tokens and insurance going down, but that may also
Speaker 5: like bring the cost up. You know, So if you're
Speaker 5: gonna use like AI for like your next generation wars,
Speaker 5: but if your enemy can just like increase your cost
Speaker 5: of token and insurance, what does that even mean? Like
Speaker 5: do you even need AI in the first place? Is
Speaker 5: it even relevant? So I think there's this all like
Speaker 5: asymmetric like warfare that's going to happen that we really
Speaker 5: haven't seen yet, and I think that's gonna be like
Speaker 5: really interesting. But at the same time, there's so much
Speaker 5: noise and so much so many things happening at once
Speaker 5: that it's becoming like extremely like hard to focus and
Speaker 5: just like extract. But that's pretty ready.
Speaker 2: But yeah, definitely feels like that tough, tough choices potentially
Speaker 2: coming for half Alock as your token costs go up. Matt,
Speaker 2: it was so wonderful to reconnect again. Thank you so
Speaker 2: much for coming back on odd lots And yeah, you'll
Speaker 2: have to get back to Joe about those APIs.
Speaker 3: Yeah, I'm happy, let's let's.
Speaker 5: Do Yeah, bring me on as sounds good.
Speaker 3: Take care of Matt.
Speaker 6: Thanks Matt, Joe.
Speaker 2: Always good to catch up with.
Speaker 4: No super interesting It's incredible how much has happened right
Speaker 4: now at this particular nexus, especially obviously the anthropic stuff.
Speaker 3: But I you know, it's interesting.
Speaker 4: You know, you think about cyber warfare and you think about, okay,
Speaker 4: we're going to hack into a system and take out
Speaker 4: critical infrastructure. But another thing you can do is just
Speaker 4: attack a data center correctly, just.
Speaker 2: Send a drone to the data center. I thought that
Speaker 2: was really interesting. That sort of like we got very
Speaker 2: used to thinking about cyber as like this thing that
Speaker 2: exists only in code, in code, but now you have
Speaker 2: this like new front of kinetic warfare where the two
Speaker 2: like really intersect.
Speaker 4: Yeah, they do really intersect, and yeah, these are like
Speaker 4: huge national security vulnerabilities. And he pointed out, I mean
Speaker 4: certainly today, but you know, was this in anyone's threat
Speaker 4: model thinking about the risks to it? You know, the
Speaker 4: cheapness of drones the ability to take them out super interesting.
Speaker 4: Also just this idea like yes, you know, obviously again
Speaker 4: as your observation, the point we think of like cyber attacks,
Speaker 4: like we're going to take out this whole thing, but
Speaker 4: in least in the warfare context. His point like most
Speaker 4: of it is like before the war et cetera, the
Speaker 4: sort of information gather spy, spy craft and so forth
Speaker 4: prior to the actual the actual attacks.
Speaker 2: But it is interesting to see Israel in particular use
Speaker 2: some cyber attacks as a sort of sewer of chaos.
Speaker 2: Definitely in Iran. I can't imagine what it's like to
Speaker 2: actually be on the ground there at the moment for
Speaker 2: many reasons, but like you imagine just being there worried
Speaker 2: about your physical safety, and then the traffic lights aren't
Speaker 2: working as well.
Speaker 4: Well, right, and also just think like wait, there's cameras
Speaker 4: everywhere or how much is being recorded? Like create like
Speaker 4: a sense of like paranoia among everyone about everything.
Speaker 2: And also the interesting thing obviously this is very topical
Speaker 2: in markets, but the SaaS apocalypse idea Matt in particular,
Speaker 2: seemed pretty bearish on the outlook for existing software companies,
Speaker 2: I guess, and I did think his comments about what
Speaker 2: that would mean for security budgets within organizations were pretty
Speaker 2: relevant and worrying. Absolutely, all right, shall we leave it there,
Speaker 2: Let's leave it there. This has been another episode of
Speaker 2: the Odd Thoughts podcast. I'm Tracy Alloway. You can follow
Speaker 2: me at Tracy Alloway.
Speaker 4: And I'm Jill Wisenthal. You can follow me at the Stalwarts,
Speaker 4: follow our guest Matt Sweish, She's at m swish Fellow
Speaker 4: or producers Carmen Rodriguez at Carmen Arman, Dash o'l bennett
Speaker 4: at dashbot, ands at Kale Brooks. And for more odd
Speaker 4: Laws content, go to Bloomberg dot com slash Oddlage for
Speaker 4: the daily newsletter and all of our episodes, and you
Speaker 4: can chat about all these topics twenty four to seven
Speaker 4: in our discord Discord dot gg slash odd Lots.
Speaker 2: And if you enjoy odd Lots, if you like it
Speaker 2: when we talk about the intersection of kinetic and cyber warfare,
Speaker 2: then please leave us a positive review on your favorite
Speaker 2: podcast platform. And remember, if you are a Bloomberg subscriber,
Speaker 2: you can listen to all of our episodes absolutely add free.
Speaker 2: All you need to do is find the Bloomberg channel
Speaker 2: on Apple Podcasts and follow the instructions there. Thanks for listening.