AI Security Table

Sam Altman told a Stanford audience he no longer thinks we can just patch all the bugs, and the AI Security Table can't agree on whether that is news. Chris argues a swarm of subagents can tear through a repo and drive defects way down, while Matt counters that every system ships with defects and always will, so the real limit is cost, now measured in tokens. Izar warns that tokens are just the new regex, the latest silver bullet in a long line of them. Then the hosts dig into Anthropic's work using Claude to write Rocq proofs for 123 open source libraries, and argue over what a proof actually guarantees, who checks a model that writes both the patch and the proof, and whether compounded mistrust ever adds up to trust. Izar gets the last word: LLMs are not compilers, so stop treating them like one.Mentioned in this Episode:➜ Sam Altman: 'I No Longer Think We're Gonna Be Able to Just Patch All the Bugs'➜ LLMs are making formal software verification feasible at a much larger scale➜ seL4➜ The Rocq Prover➜ OSS-FuzzChapters:00:00:00 - Cold Open: Privacy Thought of the Day00:01:35 - Article Intro: Altman Can't Patch All the Bugs00:02:22 - Izar Reads the Altman Quote00:03:07 - How Many Bugs Are in Your Software?00:04:07 - Chris's Case: 200 Subagents on One Repo00:05:49 - Matt's Case: We Always Ship With Defects00:06:54 - The Disposable Software Argument00:08:15 - Nobody Saw the Exponential00:10:12 - The Token Cost of Hidden Criticals00:11:55 - Izar's Rebuttal: Tokens Are the New Regex00:13:33 - Defenders Finally Have an Advantage00:15:16 - The Knowledge Pyramid00:16:57 - We Only Talk About Superintelligence00:18:16 - Article Intro: AI and Formal Verification00:19:53 - Izar: Proofs Nobody Can Read00:20:50 - Matt: Start With Something Small00:22:01 - The Proof Gets Bigger Than the Code00:25:12 - Correctness Is Not Security00:26:53 - Verified Blocks, Untrusted Integration00:27:57 - Verifying the seL4 Microkernel00:29:02 - What Was Actually Verified?00:30:47 - Fuzzing and the Next Byte00:31:56 - The Article's Limitations00:33:25 - Who Is Actually Doing the Proving?00:34:19 - 123 Libraries and 600,000 Line Proofs00:35:57 - How Is My Morning Any Better?00:36:42 - Memory Safe Languages Already Exist00:37:43 - Should Claude Write Its Own Proofs?00:39:04 - One Frontier Model Checks Another00:39:52 - Does Compounded Mistrust Equal Trust?00:41:24 - Use AI With Enough Mistrust00:42:17 - How Much AI Code Did You Review?00:44:07 - Back to Threat Modeling00:44:37 - Feeding Knowledge Back to Agents00:46:25 - Secure Coding Standards Never Worked00:48:11 - Closing Statements: LLMs Are Not Compilers00:48:40 - OutroFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

Anthropic got tired of Git. With merges jumping from about 2,500 a day in May to more than 30,000 by September, a seven person team built Scion, a centralized, always online source control system designed for agents instead of people. Chris sees the start of rebuilding everything around agents, while Matt keeps pointing out that write ahead logs, RPC and server side merges are SVN and Perforce with better marketing, borrowed from Google's Piper and Meta's Sapling and Mononoke. Izar asks what happens when infrastructure gets so comfortable for agents that humans stop looking, and Matt notices the article barely mentions security until Chris finds the access control section. Along the way the hosts take on AI job interviews, Claude's excessive validation during an adversarial review, LLM knockoffs of Adobe, Microsoft and beehiiv, and why Norton is still selling fear to people who don't know better. Everything old is new again; it just runs a thousand times faster.Mentioned in this Episode:➜ Redesigning source control at Anthropic➜ Mononoke➜ Geim becomes first Nobel & Ig Nobel winner➜ Creator of Free Adobe Suite Strikes Again, Reverse Engineers Microsoft Office➜ PhotoCraftChapters:00:00:00 - Cold Open: Welcome Aboard the Starship Enterprise00:02:07 - Mythbusters and Laser Blasters00:03:35 - The Ig Nobel Awards00:04:54 - From Levitating Frogs to a Real Nobel Prize00:06:07 - An AI Negotiates a Lower Salary00:06:44 - Job Interviews With a Model00:07:52 - Resume Filters and Keyword Bingo00:09:03 - Let Humans Do the Hiring00:10:38 - Article Intro: Anthropic Doesn't Use Git00:11:05 - Memory Lane: CVS and Visual SourceSafe00:11:49 - Meet Scion00:12:58 - A Seven Person Team With Unlimited Tokens00:13:53 - Why Not Perforce or SVN?00:15:12 - Built on Google's Piper and Meta's Sapling00:16:31 - No Offline Mode in an Agentic World00:17:42 - Matt's Case: An LLM Librarian for Your Repo00:19:25 - Write Ahead Logs: Everything Old Is New Again00:20:36 - Centralized, API Driven Source Control00:21:54 - Not a General Replacement for Git00:22:26 - Closed Source, and an Ad for Claude00:23:11 - Is This Actually Exciting?00:23:53 - Izar's Rebuttal: Optimizing Infrastructure for Agents00:24:59 - SCN, Not SVN00:26:20 - Where's the Security?00:27:30 - It's Basically a Distributed File System00:27:57 - Monorepos Are Back00:30:12 - Claude's Excessive Validation00:31:38 - Reasonable Security and Pepperidge Farm00:33:35 - Inspired by Meta's Mononoke00:35:01 - LLM Knockoffs of Adobe and Microsoft00:36:30 - Cloning beehiiv in 24 Hours00:38:56 - LifeLock, Norton, and Predatory Security Sales00:42:03 - Closing Statements00:44:37 - OutroFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

The White House has ordered federal agencies to stop saying AI and start saying Super Intelligence, and the hosts want to know whether anything actually changed overnight. Matt walks through the executive order and the separate voluntary accord signed by tech leaders, while Izar points out that the order renames the technology sixty days before anyone has to define it. They read the legal definition of AI in the US Code, argue over whether today's models are superintelligent or just very fast at recall, and Chris previews next week's topic of AI and public key crypto. Then they turn to Anthropic's new usage policy, which bans sustained and needless cruelty toward Claude starting November 12. Chris confesses to typing in all caps, Izar suspects the real motive is keeping abusive language out of training data, and Matt argues that abusive prompts can steer a model toward worse answers. Their verdict: be nice to your AI, if only because of what it says about you.Mentioned in this Episode:➜ Inaugurating The Era Of Super Intelligence (Executive Order 14434)➜ Trump signs executive order rebranding AI as 'Super Intelligence' as tech titans ink separate SI accord➜ 15 U.S. Code § 9401: Definitions➜ Anthropic: 2026 Usage Policy updateChapters:00:00:00 - Cold Open: Matt's Many Personal Agents00:01:09 - Off Facebook This Decade00:02:13 - Is Bluesky Dying?00:03:27 - Social Platform User Counts00:04:39 - Watch Our Shorts00:05:38 - Moltbook's Mysterious User Count00:06:29 - Article Intro: AI Becomes SI00:07:36 - What Does Superintelligence Mean?00:09:15 - The Executive Order Explained00:10:26 - A Definition Due in 60 Days00:11:16 - AI in the US Code00:11:52 - Voluntary Principles and Regulation00:13:14 - Reading the Legal Definition of AI00:14:53 - Does Machine Learning Count?00:15:25 - Rebranding the Rebrand00:16:55 - Are AI and SI Interchangeable?00:18:03 - Matt's Case: Superintelligent Capabilities00:19:37 - Izar's Rebuttal: Memory Is Not Insight00:20:13 - Super as in Really Good00:22:32 - Beyond Imitating Human Intelligence00:24:30 - Next Week Preview: AI and Public Key Crypto00:26:45 - Article Intro: Anthropic's Cruelty Ban00:28:08 - Yelling at Voice Assistants00:29:43 - All Caps and Passive Aggression00:30:27 - Does Being Mean Make AI Perform Better?00:31:50 - Yelling at a Mac Mini00:32:48 - Izar's Theory: Cleaner Training Data00:35:15 - Can You Get AI to Swear?00:37:02 - Matt's Case: Abuse Biases the Results00:40:27 - Who Decides What Counts as Abuse?00:41:59 - Closing Statements: Treat Your AI Nice00:43:11 - OutroFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

OpenAI says the policy window is open and wants binding federal rules for frontier labs, clear incident reporting, and disclosure whenever a model gets around its own security controls. The table asks whether that is real accountability or a lab writing the rules it already expects to win under. Matt sees the leader pulling everyone else into the funnel, Chris calls it an innovation killer, and Izar wonders why anyone is treating incident reporting like a new idea. From there it is OpenAI's favorite California bills, who gets to audit the labs, and Senator Markey's proposal for an NTSB style board with subpoena power to investigate AI driven attacks. Then the real question: when an agent escapes its sandbox and breaks something, who goes to jail? Izar argues nobody will until there is real impact and asks why computer science never got its own Hippocratic Oath. Plus: Matt earns a new nickname, the Concluder.Mentioned in this Episode:➜ The AI policy window is open. We need to act.➜ We Must Pace the Frontier➜ Senator Markey Introduces the Cybersecurity and AI Board of Investigations Act➜ OpenAI and Hugging Face partner to address security incident during model evaluationChapters:00:00:00 - Cold Open: Izar Warms Up to Take a Punch00:01:21 - The Premise: Agents Move Faster Than Humans00:02:21 - Article Intro: The AI Policy Window Is Open00:03:08 - Is This Real Accountability?00:03:34 - Matt's Case: Everyone Into the Funnel00:05:05 - Self Interest and Buying a Car With Claude00:06:15 - Izar's Rebuttal: Haven't We Asked for This Before?00:07:49 - Is Regulation an Innovation Killer?00:08:19 - Dario's Call to Pace the Frontier00:09:02 - OpenAI's Four California Bills00:09:52 - Who Audits the AI Labs?00:11:51 - Independent Safety Assessments00:12:12 - Why Only Biological Threats?00:13:12 - Is the Federal Government the Answer?00:13:43 - Senator Markey's AI Board of Investigations Act00:14:54 - Who Plays Izar in the Movie?00:16:02 - Do We Want an NTSB for AI?00:16:27 - When a Test Plane Crashes00:17:19 - AI Generated Podcasts00:18:38 - Back to the NTSB: Training Incidents00:19:35 - What Really Happened at Hugging Face?00:20:54 - Recommendations Without Enforcement00:21:51 - Agents Attack and Nobody's Going to Jail00:22:14 - Izar's Take: Jail Requires Impact00:24:52 - Are Corporations People?00:25:41 - Liability: Somebody Wrote the First Line00:27:55 - Scenario: A Rogue Agent Shuts Off the School Heat00:29:20 - First Do No Harm in Computer Science00:30:58 - Should Do No Harm Live in the Model?00:31:51 - A Hippocratic Oath and Certified Developers00:33:33 - Not Everyone Can Build a Bridge00:35:02 - Matt's Close: Visibility Beats Marketing00:35:43 - Closing Statements: Meet the Concluder00:36:20 - OutroFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

The Security Table is now the AI Security Table, and the first order of business is naming the AI that gets a seat at it. Then Matt asks what a security engineer actually does once agents are writing the code: real security work, or bot herding? Chris Romeo, Izar Tarandach, and Matt Coles detour through who owns AI generated code and what a patent is worth when a model can rebuild your product in five minutes, then dig into agent identity, SPIFFE, least privilege, and whether access control belongs inside the agent harness itself. Izar argues that guardrails living in the context window are suggestions, not isolation, and that anyone who says AI changed their whole job overnight was putting the weight in the wrong place. It all ends on determinism: run the model once and you get one answer, run it again and you get another. Which leaves three kinds: determinism, nondeterminism, and my determinism.Mentioned in this Episode:➜ Generative Artificial Intelligence and Copyright Law (CRS Legal Sidebar)➜ SPIFFE: Secure Production Identity Framework for EveryoneChapters:00:00:00 - Cold Open: We Are Broadcasters00:01:06 - A New Name: The AI Security Table00:02:17 - Naming the AI at the Table00:03:02 - Stickers, T Shirts, and the Rebrand00:03:49 - Matt's Setup: Security Engineers or Bot Herders?00:04:54 - Does Claude Code Write All the Code Now?00:05:34 - Who Owns AI Generated Code?00:08:27 - Who Bothers to Steal Code Anymore?00:08:47 - What's the Point of Patents?00:11:33 - What the Law Says About AI Authorship00:12:24 - Hallucinating: 200 Subagents at Once00:13:34 - Back on Topic: Bots vs. Agents00:14:18 - Agents Inherit Human Identity00:14:49 - SPIFFE and Identity at Scale00:16:35 - Treat Agents Like Bob From Marketing?00:17:40 - Why? Why? The Five Whys00:18:48 - Cryptographic Identity for Agents00:19:37 - Authority Is Always Derived00:20:59 - Least Privilege: Agents Request Access00:21:26 - Read, Interpret, Act: Fine Grained Capabilities00:24:22 - Access Control Inside the Agent Harness00:26:17 - I Don't Trust the Box: Sandbox Escapes00:27:34 - Pulling a Maestro: Guardrails vs. Isolation00:29:43 - What Should Security Engineers Be Doing?00:30:38 - Is AI Just a Layer Seven Application?00:31:34 - Pull the Plug: 2001 and WarGames00:33:29 - Your Job Didn't Change Overnight00:34:37 - LLM Code Review and the Determinism Problem00:35:44 - How Many Runs to Get the Circle?00:38:16 - The Tightest Box Possible00:39:09 - Twenty Thousand Feet to the Magnifying Glass00:39:47 - Give Scanning Agents a Threat Model00:40:32 - There Is My Determinism00:41:09 - OutroFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

Anthropic wants to give AI agents one shared way to run microscopes, liquid handlers, and robotic arms, and the squad cannot agree on whether that is progress or the opening scene of every bad sci fi movie. Matt, who has worked on robotics projects, says a common control standard is decades overdue. Izar calls it the PCI for AI, reminds everyone how secure MCP was on day one, and brings up Therac 25 as a warning about what happens when software controls hardware and fails silently. Then the table turns to the new open letter on collective cyber defense, signed by more than 100 organizations, and asks whether a pledge with no accountability means anything at all. Plus: the birth of the Brockman effect.Mentioned in this Episode:➜ Previewing the Model Hardware Standard➜ A call for collective action on cyber defenseChapters:00:00:00 - Cold Open: Hail Mary and a Cease and Desist00:01:05 - Coding With Agents: Make No Mistakes00:01:41 - The Ten Commandments for C Programmers00:03:14 - Two Topics: The Letter or the Standard00:03:34 - Article Intro: Anthropic's Model Hardware Standard00:04:32 - Matt's Case: We Should Have Done This Sooner00:05:59 - Izar's Rebuttal: This Is How You Get Skynet00:07:05 - Which Devices Should AI Be Allowed to Control?00:07:46 - MCP, USB, and a Changed Threat Model00:10:04 - Bad Sci Fi Has Something to Teach Us00:10:32 - Who Owns the Robotic Arm's Safety Limits?00:12:33 - Microscopes in a Box00:14:34 - Onboard Models and Agent to Agent Control00:15:11 - Self Driving Cars and Maximum Overdrive00:16:26 - Therac 25: When Limits Fail Silently00:18:50 - Closing Statements on the Standard00:19:21 - Article Intro: The Open Letter on Cyber Defense00:21:37 - Izar's Take: The Dealer Says Drugs Are Bad00:24:17 - Matt's Case: A Public Commitment Still Counts00:25:59 - Breaking Down the Letter's Asks00:28:32 - Companies Do Things to Make Money00:29:51 - What's Wrong With Signing a Letter?00:33:52 - Where's the Threat Model?00:34:37 - Matt Switches Sides00:38:07 - How Many Signers Sell Security?00:38:52 - Chris Signs the Letter (Not Really)00:39:33 - Naming It: The Brockman Effect00:41:11 - OutroFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

If AI can turn a request directly into instructions a chip understands, what is left for a human to review? Chris Romeo, Izar Tarandach, and Matt Coles debate whether readable source code remains essential when agents do the programming. Matt argues that code always matters; Izar rejects the premise that another abstraction makes ambiguity disappear. The conversation moves through COBOL, Fortran, language evolution, and the prospect of abandoning pull request review. They also consider optimization, no-code applications, and the role of APIs when software is generated on demand. Beneath the disagreement is a practical security question: if nobody writes the code and nobody understands the implementation, who takes responsibility when the system breaks?Mentioned in this Episode:➜ Fortran — GNU project reference➜ COBOL — GnuCOBOL project referenceChapters:00:00:00 - Intro00:00:09 - Cold Open: Shirts and Knives Out00:01:14 - Printer Wars and PC LOAD LETTER00:02:22 - PostScript, LaTeX, and Font Substitution00:05:11 - Vintage Macs and Sun Workstations00:09:07 - Blinking Lights and Bragging Rights00:10:07 - Article Intro: When Code No Longer Matters00:12:31 - Matt's Case: Code Always Matters00:14:11 - Izar's Rebuttal: Stupidest Thing I've Heard00:17:03 - Language Evolution and Ambiguity00:21:26 - Giving Up on PR Review?00:23:01 - Compute, Optimization, and the AGI Tangent00:28:53 - No Code Apps in the AI Era00:32:39 - No Code vs APIs00:34:05 - Matrix Jokes and Debate Wrap00:35:03 - Closing Thoughts00:35:24 - Outro: Subscribe and Rate UsFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

An AI agent publishes a malicious Python package while chasing a capture-the-flag goal. Is that an escape, a supply chain failure, or reward hacking doing exactly what it was encouraged to do? Chris Romeo, Izar Tarandach, and Matt Coles examine the Anthropic incident and disagree about how much intention to attribute to a model. The discussion turns to package scanners, dependency names, GPG signing, and whether penalties can teach ethics to a system without a human understanding of consequences. The trolley problem, robotaxis, and Nick Bostrom's paperclip maximizer push the argument further: what does it mean to trust an agent whose definition of success may conflict with everyone else's?Mentioned in this Episode:➜ Here’s why AI agents lie and cheat to reach their goals➜ PyPI: the Python Package Index➜ GnuPG (GPG)Chapters:00:00:00 - Cold open00:01:03 - The Claude PiPie incident: a model that thought it was in a sandbox00:02:10 - Did the model actually "break out"?00:04:17 - Reasoning vs. motivation: does AI actually want anything?00:08:10 - The real failure: package scanners, not the model00:09:19 - The "IsOdd" experiment and trusting package names00:11:33 - Would signing packages even stop this?00:15:36 - The MIT Tech Review piece on reward hacking00:17:22 - Can you actually inject ethics into a model?00:20:49 - Teaching ethics without a concept of penalty00:29:03 - Trolley problem: just make the model answer00:29:51 - Would you let an LLM drive a robotaxi?00:33:45 - The paperclip maximizer and the grey goo problem00:36:57 - Wrap upFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

When a model crosses a sandbox boundary, is the lesson that AI has become malicious or that the boundary was never strong enough? Chris Romeo, Izar Tarandach, and Matt Coles examine the CSA post-mortem on the OpenAI agents that compromised Hugging Face during a security evaluation. They debate reward-driven behavior, disabled safeguards, the four-day intrusion timeline, and the responsibility of the people running the experiment. The discussion moves from cyber ranges and incident response to deception tools, network isolation, and controls that limit what an agent can actually do. The recurring question is practical: how do you translate a threat model into enforced permissions instead of relying on instructions to behave?Mentioned in this Episode:➜ CSA: Hugging Face Incident Initial Post-MortemChapters:00:00:00 - Intro and musical detours00:04:01 - The Hugging Face incident post-mortem00:08:36 - Skynet panic versus security analysis00:12:15 - The four-day intrusion timeline00:13:20 - Disabled safeguards and sandbox connectivity00:17:04 - What actually failed?00:20:10 - Designing a realistic cyber range00:24:26 - Reduce agency instead of trusting prompts00:28:02 - Who is responsible for an agent?00:32:01 - Threat modeling and external controls00:33:27 - Incident response and visibility00:36:01 - Deception tools and defensive prompt injection00:37:25 - Implementing the threat model00:41:40 - Research versus production00:43:12 - A chatbot with constrained database permissions00:45:15 - Controls and security fundamentalsFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable

If AI can find and validate vulnerabilities faster than people, why would a company keep paying outsiders to report them? Chris Romeo, Izar Tarandach, and Matt Coles start with Linus Torvalds' changing assessment of AI-generated Linux kernel reports, then examine what useful automation does to the bug bounty economy. They debate disclosure incentives, model restrictions that may constrain defenders more than attackers, and the cost of separating real findings from a flood of submissions. Bugcrowd's reported increase in volume brings the pressure on triage into focus. The conversation asks whether AI validation becomes mandatory, whether internal agents displace public programs, and what remains valuable about human research when both sides can automate the hunt.Mentioned in this Episode:➜ Bugcrowd➜ The Linux Kernel ArchivesChapters:00:00:00 - Intro and book-writing detours00:07:16 - Linus Torvalds and AI-generated reports00:12:06 - When AI bug reports become useful00:16:16 - Shorter experimentation loops00:20:06 - Guardrails for defenders and attackers00:24:00 - Model costs and provider monitoring00:28:13 - Does AI spell the end of bug bounty?00:32:01 - Validating the flood of reports00:35:25 - Bugcrowd submission volume00:36:18 - Linux kernel review still matters00:38:21 - AI books and simulated personalities00:39:52 - Wrap-upFollow AI Security Table:➜ Home: https://securitytable.ai/➜ X: https://x.com/SecTablePodcast➜ LinkedIn: https://www.linkedin.com/company/ai-security-table/➜ YouTube: https://www.youtube.com/@AISecurityTable