Calif Warns AI Coding Models Automate Cyber Exploits in Hours
Bloomberg
Commercial incentives to train frontier AI on software engineering inevitably create machine-speed offensive hacking tools that collapse patching windows and outrun enterprise defenses.
AI-assisted summary of PHP2Shell Won't Be the Last Big AI Cybersecurity Risk — original source. Check the original for full context.
Source published:
Key ideas
- Cybersecurity researchers at Calif used frontier AI models to turn a dormant, unpatched vulnerability in PHP into a fully functional remote exploit (PHP2Shell) within 24 hours. (20:00)
- Automated reasoning tools have established a 'minus one-day' vulnerability window, where AI 'n-day factories' monitor open-source commit diffs to synthesize exploits before downstream users can package or deploy official patches. (40:00)
- The dual-use dilemma in software makes selective AI restriction impractical: training frontier models to excel at code synthesis and debugging inherently equips them with advanced offensive exploitation skills. (43:08)
- AI-accelerated intrusions are shifting breach timelines from weeks to hours, as demonstrated in recent banking incident responses where autonomous agents established wide lateral network footholds overnight. (50:00)
Detailed notes
## Background Published on October 30, 2026, by Bloomberg on the Odd Lots podcast feed, this episode explores the escalating security risks posed by frontier artificial intelligence models. According to the show notes, cybersecurity researchers used advanced AI to uncover a long-dormant vulnerability in PHP—a language powering roughly 70% of the web—prompting hosts Tracy Alloway and Joe Weisenthal to interview Calif CEO Thai Duong and engineer Bruce Dang about uncovering the bug, partnering with AI labs, and the future of digital defense.
## TL;DR Calif security researchers Thai Duong and Bruce Dang break down how their team leveraged OpenAI-backed frontier models to unearth legacy flaws in PHP and generate weaponized exploits like PHP2Shell within twenty-four hours. They explain how AI tools are collapsing traditional security lifecycles, enabling automated 'n-day factories' to reverse-engineer public patches into working exploits before downstream users can upgrade. The discussion reveals that even hardened codebases like Google Chrome harbor thousands of latent flaws, while real-world threat actors now deploy coordinated swarms of AI agents capable of compromising entire corporate banking networks overnight. Ultimately, the guests argue that cybersecurity has entered a brief, volatile 'centaur hacker' era, warning that commercially training AI to write code inherently creates world-class offensive hackers.
## Atmosphere & style The conversation begins with Tracy Alloway and Joe Weisenthal's characteristic easygoing banter and self-deprecating admissions of cybersecurity ignorance, but steadily darkens into a sobering, high-stakes exploration of systemic digital fragility. Duong and Dang speak with the understated, matter-of-fact calm of seasoned red-team veterans, delivering technical post-mortems on broken encryption and machine-speed intrusions without sensationalism. Listening to the interview feels like watching comforting assumptions about modern software security systematically dismantled in real time, leaving the hosts and audience with a disquieting realization that the software running the global economy is far more vulnerable than previously imagined.
## Bulletin - `20:00` Cybersecurity researchers at Calif used frontier AI models to turn a dormant, unpatched vulnerability in PHP into a fully functional remote exploit (PHP2Shell) within 24 hours. - `40:00` Automated reasoning tools have established a 'minus one-day' vulnerability window, where AI 'n-day factories' monitor open-source commit diffs to synthesize exploits before downstream users can package or deploy official patches. - `43:08` The dual-use dilemma in software makes selective AI restriction impractical: training frontier models to excel at code synthesis and debugging inherently equips them with advanced offensive exploitation skills. - `50:00` AI-accelerated intrusions are shifting breach timelines from weeks to hours, as demonstrated in recent banking incident responses where autonomous agents established wide lateral network footholds overnight.
## Key takeaways - `03:00` PHP powers roughly 70% of the world's web infrastructure, making latent runtime vulnerabilities a systemic risk across the internet ecosystem. - `10:00` Historical attacks like CRIME demonstrated that combining compression with encryption leaks ciphertext length side-channels, illustrating how basic architectural assumptions can be fundamentally flawed. - `13:58` AI models have transformed exploit weaponization from an exhaustive, months-long reverse-engineering effort into an automated engineering problem completed in days or hours. - `22:42` The PHP Foundation left a known 2024 vulnerability unpatched due to the high risk of breaking widespread production code without proof of an actionable exploit. - `30:00` Automated auditing has revealed that supposedly hardened codebases, including Google Chrome, harbored far more latent vulnerabilities than defenders historically assumed. - `31:39` Formal mathematical verification cannot realistically secure modern application suites like web browsers due to their vast multi-billion-line complexity and the commercial need for constant, rapid code iteration. - `40:00` Open-source development models inadvertently provide attackers with an exploitation advantage when public repository commit diffs are weaponized before user updates occur. - `43:08` Treating AI containment simply as a model training or sandboxing challenge overlooks the commercial incentive driving AI labs to build world-class code debugging and execution engines. - `46:12` Firmware reverse engineering and complex multi-stage attack chains (such as iOS exploits) are increasingly democratized by inexpensive open-source and frontier models. - `50:00` Machine-speed enterprise breaches operating across dozens of parallel vectors render conventional detection-and-response playbooks largely obsolete for critical infrastructure like banking. - `51:45` Offensive cybersecurity is currently in a temporary 'centaur' phase where elite human researchers paired with LLMs outperform purely manual human analysts or autonomous agents. - `51:45` The historical transition from human-AI hybrid play in chess (ten years) to Go (three years) suggests the cybersecurity centaur window could close rapidly as models gain autonomy.
## Detailed walkthrough ### `00:00` Pre-Roll Ads and the Culture of SpaceX
The segment opens with brief sponsor notices from the Barclays Brief podcast and the Delta SkyMiles Reserve Business American Express card, before transitioning to a Bloomberg Tech Minute report hosted by Carol Masser on hiring practices at SpaceX. Masser highlights reporting from Bloomberg Businessweek's Lauren Grush, explaining that landing a position at SpaceX requires extraordinary aptitude and may involve personal review by Elon Musk. Musk defines the corporate culture, requiring candidates to show complete loyalty to him and demonstrate innate, raw intelligence alongside past credentials. Job advertisements candidly warn prospective employees that positions require stamina, demanding long hours and weekend work, with equity—in the form of stock options or restricted stock units (RSUs)—offered as the main incentive for enduring the grueling workload.
`03:00` "Black October" and the Growing Cybersecurity Scare
Odd Lots hosts Tracy Allaway and Joe Weisenthal open their conversation on October 29th by discussing "Black October." While Joe initially assumes the moniker refers to a plunge in the financial markets, Tracy points out that the phrase has instead caught fire across the cybersecurity landscape. A wave of high-severity security vulnerabilities has surfaced, most notably in PHP, an open-source programming language that powers roughly 70% of the web. What distinguishes this round of discoveries is that security researchers leveraged frontier AI models to uncover vulnerabilities that had remained buried for decades.
This breakthrough has reignited the existential question of whether advanced AI models make the digital landscape safer by empowering defensive researchers, or far more dangerous by giving malicious actors scalable tools to automate exploits. Joe notes that awareness has spiked ever since Anthropic unveiled its Mythos model—now known as Project Glasswing—which was shared with select corporate defenders to help identify critical flaws before being rolled out to the general public.
```mermaid flowchart TD accTitle: The AI Cybersecurity Dilemma accDescr: Visualizing the parallel capabilities enabled by frontier AI models for offensive and defensive actors. AI["Frontier AI Models<br/>(e.g., Anthropic Mythos / Project Glasswing)"]
subgraph Def ["Defensive Use Case"] D1["Scan Open-Source Infrastructure<br/>(e.g., PHP codebase)"] D2["Surface Deeply Hidden Vulnerabilities"] D3["Coordinated Disclosure & Patching"] end
subgraph Off ["Offensive Threat"] O1["Automated Exploit Discovery"] O2["Identify Unpatched Weaknesses"] O3["Scale Zero-Day Attacks"] end
AI -->|"Applied by Security Researchers"| D1 D1 --> D2 D2 --> D3 AI -.->|"Risk of Exploitation by Malicious Actors"| O1 O1 --> O2 O2 --> O3 ```
Joe openly admits his own lack of knowledge regarding cybersecurity fundamentals, confessing that he does not understand what security firms actually sell, nor how an enterprise buyer can truly verify whether protection works or if the company simply avoided being targeted. He jokes that hackers listening are likely taking notes on his digital vulnerabilities, but notes that everyday users have felt the surge in real time through relentless corporate notifications warning of breaches and instructing them to reset credentials and refresh security keys.
- Tracy highlights that while the PHP flaw has existed unnoticed for years, the true inflection point is using AI to uncover it. - Joe points to Anthropic's Mythos and Project Glasswing as landmark releases shifting cybersecurity priorities into public awareness. - “Pretty much everyone agrees cybersecurity is a real thing, and it's happening right now,” says Joe Weisenthal.
`05:00` Introducing Calif: Stuxnet and Breaking Internet Encryption
Tracy introduces their two guests from Calif, one of the elite cybersecurity firms that uncovered the major PHP vulnerabilities alongside cloud security company Wiz: CEO Thai Duong and engineer Bruce Dang. Asked to describe the most remarkable feats of their respective hacking careers, Dang recounts his beginnings nearly twenty years ago at Microsoft within the Microsoft Security Response Center (MSRC), the team responsible for rolling out monthly "Patch Tuesdays."
Dang reveals that one of his most prominent projects involved reverse-engineering the infamous Stuxnet worm, which had been deployed to sabotage the Iranian nuclear program. Joe notes that popular culture views Stuxnet as the world's first true digital cyber weapon. Following his time at Microsoft, Dang launched a startup with friends, moved to Apple to work on iOS platform security, and was eventually persuaded to enter the AI space. “And then Thai managed to convince me to follow the church of AI. And so here I am,” says Bruce Dang. Thai jokes that it took four full years to recruit him.
Thai Duong shares his own background in fundamental cryptography and transport protocol security. He explains that whenever users connect to sites like Amazon, Facebook, or Instagram, their data passes through dozens of intermediate nodes, including local Wi-Fi routers and internet service providers (ISPs). Securing that traffic requires robust encryption protocols—originally Netscape's SSL and subsequently Transport Layer Security (TLS). Duong and his collaborators became famous for discovering major flaws in these protocols, which successfully broke the encryption and allowed data to be decrypted in transit. Their research proved that legacy implementations like SSL 3.0, invented by Netscape three decades earlier, were fundamentally broken, prompting the entire internet infrastructure to finally deprecate and remove SSL 3.0.
Duong then touches on a classic cryptographic problem he explored while studying at Stanford University: whether data should be compressed before it is encrypted, or encrypted before it is compressed. While both techniques introduce randomness to raw binary data—making zip archives look completely chaotic—the standard academic assumption was that one must never encrypt prior to compression because the uniform randomness produced by encryption ruins the compression algorithm's ability to locate redundancies.
- Bruce Dang's career spans the Microsoft Security Response Center (MSRC), reverse-engineering Stuxnet, and hardening iOS security at Apple. - Thai Duong built his reputation by systematically attacking and breaking widely deployed transport protocols, notably SSL 3.0 and early TLS versions. - Duong's research forced the global web infrastructure to retire Netscape's legacy 30-year-old SSL protocol in favor of modern encryption standards.
`10:00` Breaking Cryptographic Assumptions: The CRIME Attack Mechanics
Thai Duong recalls a cryptography course assignment from around 2011 where the accepted textbook answer was that one should compress data first and then encrypt it. Three years later, security researchers discovered that this conventional wisdom was fundamentally flawed, enabling attackers to decrypt sensitive information. Compression works by eliminating redundant data; the more redundancy present in a message, the smaller the compressed output becomes. While encryption scrambles the plaintext, standard encryption schemes do not conceal the length of the ciphertext. Consequently, an observer can inspect the resulting ciphertext length to deduce whether the input contained repeated information, creating a dangerous side-channel leakage.
```mermaid flowchart TD accTitle: CRIME Attack Mechanism accDescr: Diagram illustrating how combining attacker input with a secret before compression leaks length information through ciphertext.
subgraph Input ["Data Concatenation"] A["Attacker-Controlled Guess"] B["Target Secret (e.g., Cookie / Password)"] A --> C["Concatenated Plaintext"] B --> C end
subgraph Processing ["Transport Security Pipeline"] C --> D["Data Compression (e.g., DEFLATE / gzip)"] D --> E["Encryption with Unknown Key"] end
subgraph Observation ["Adversary Analysis"] E --> F["Ciphertext Sent Over the Wire"] F --> G["Measure Ciphertext Byte Length"] G --> H{"Shorter Length Detected?"} H -- "Yes" --> I["Redundancy Confirmed: Guess Was Correct"] H -- "No" --> J["Try Next Character Guess"] I --> K["Recover Full Secret Byte by Byte"] J --> A end ```
Duong illustrates how an adversary weaponizes this mechanism against web encryption protocols. If an attacker injects a chosen string into a session where the protocol appends a victim's secret—such as an authentication cookie or password—both strings are compressed and encrypted together before being transmitted over the wire. If the attacker's guess matches characters in the secret, the compression algorithm identifies redundant data, yielding a noticeably shorter payload. By systematically repeating this process and measuring packet sizes, an adversary can recover an entire secret byte by byte: “They take my data, they concatenate your password, they encrypt together, they compress together, and then they send over the wire. And then as an attacker, I can see the length, and that's enough for me to decrypt.” Because fixing the mathematical interaction between compression and encryption proved intractable, protocol maintainers were forced to eliminate the vulnerability entirely by disabling compression across transport protocols.
---
`12:35` From Saigon to Google: Duong's Career in Offensive Security
Duong recounts his journey from growing up in Saigon, Vietnam, to becoming an offensive cryptographer in Silicon Valley. In 2011, he secured a consulting position in Mountain View, California, and later that same year joined Google. Over a 12-year tenure at the company, Duong worked across flagship platforms, including Gmail and Google Chrome, focusing on identifying implementation vulnerabilities and preventing cryptographic errors before software reached the public. Duong frames his internal role as that of an authorized adversary tasked with preempting external attackers: “Google has a lot of products, right? Gmail, Chrome browser that we are using right now. And there's a lot of people out there that want to hack Google and our products. So my job was to hack these products before we released them to the public.” After over a decade of auditing and breaking Google products, Duong left the company to co-found Calif, applying offensive security methodologies to modern software ecosystems.
---
`13:58` The Shift to AI-Accelerated Vulnerability Discovery
When asked whether artificial intelligence represents an entirely novel paradigm for cybersecurity or merely an evolution of longstanding dynamics, Bruce Dang argues it represents an intersection of both. Software architectures have always contained latent bugs exploited by security engineers and malicious hackers, but frontier AI models have dramatically compressed the time and human labor required to discover and operationalize them. Tasks that once required multi-person teams working for months can now be performed at machine speed: “What AI has done is it's kind of accelerated the speed in which you identify and exploit these vulnerabilities to a level where it's almost like superhuman.”
Dang points to the explosive expansion of software maintenance to illustrate this shift in scale:
- **Historical patch volume**: Two decades ago, a vendor like Microsoft would issue approximately 20 security updates per month. - **Current patch volume**: Today, that figure can reach roughly 1,400 monthly updates, with the total continuing to climb. - **Exploitation efficiency**: Targets that previously required three months of dedicated manual effort by a red team can now be mapped and exploited far more rapidly with access to capable AI models. - **Systemic impacts**: This acceleration alters how threat actors probe high-value targets, including the financial and banking sectors, by rendering edge-case vulnerabilities visible and actionable at scale.
---
`18:24` The PHP Vulnerability and the Frontier Model Collaboration
The discussion shifts to how Calif, cloud security company Wiz, and OpenAI coordinated on discovering and evaluating a critical vulnerability in PHP. The hosts note that the disclosure drew scrutiny from portions of the developer and security community because Calif publicized research surrounding the vulnerability before complete patches were deployed across all affected environments. Duong explains that Calif's primary objective is identifying bugs with structural, systemic impact across the global internet infrastructure, seeking to understand fundamental failure modes so developers can implement permanent mitigations rather than temporary fixes. This research focus led Calif to collaborate directly with frontier AI labs to evaluate how cutting-edge models expose latent vulnerabilities in legacy open-source software.
`20:00` Pitching OpenAI and Unearthing PHP's 25-Year Vulnerability History
Calif tapped into an OpenAI grant program designed to fund security firms to help open-source maintainers identify and mitigate critical vulnerabilities in their software. Within Calif, engineer Ryan Austin acted as an in-house PHP historian, recently presenting a detailed breakdown of 25 years of PHP vulnerabilities at a San Francisco conference alongside the unveiling of PHP2Shell. The company’s standard operating model relies on giving engineers the freedom to hack technologies they find intrinsically interesting, while the business side figures out how to secure corporate sponsorship: “Our engineer, they're interested in certain things, and then they just go and hack those things. And, you know, as business people who try to see, okay, how can we convince some other people to pay us for this work? And that's exactly what we did with OpenAI.” Calif pitched OpenAI on funding an effort to audit PHP, securing both compute tokens and financial backing, before reaching out directly to the PHP Foundation.
Connecting with the PHP Foundation required an introduction from legendary security researcher Stefan Esser, who had joined Calif roughly six months prior. Esser had spent decades auditing and hardening PHP, earning a reputation among maintainers and researchers that one host compared to an Indiana Jones-type folklore figure depicted in Calif’s marketing comics. Leveraging Esser's name, Calif met with Volker Dusch at the PHP Foundation. On July 30, Calif initiated the research project, and within forty-eight hours, Austin discovered the first major flaw. Austin had specifically looked for classes of bugs resembling one Esser had disclosed 22 years earlier, and to his surprise, PHP's modern codebase was still populated with similar weaknesses. Calif promptly reported the critical issue back to the foundation, recognizing that it could expose vast swaths of the public internet to remote compromise.
```mermaid flowchart TD accTitle: Calif PHP Vulnerability and Exploit Disclosure Flow accDescr: Diagram tracing OpenAI funding to Stefan Esser's intro, Ryan Austin's bug rediscovery, and Calif's AI-assisted exploit generation. subgraph S1["1. Funding & Access"] A["OpenAI Grant Program<br>(Tokens & Funding)"] --> B["Calif Security Team"] C["Stefan Esser<br>(Calif Researcher & PHP Veteran)"] -->|"Introduces Calif"| D["Volker Dusch<br>(PHP Foundation)"] end subgraph S2["2. Discovery & Exploitation"] B --> E["Ryan Austin<br>(Calif Engineer)"] E -->|"Identifies bug akin to<br>Esser's 2002 flaw"| F["Critical Vulnerability Reported<br>(Found July 30)"] F --> G{"PHP Foundation Status:<br>Known in 2024, but unpatched<br>due to lack of proof-of-concept"} G -->|"Foundation requests proof"| H["AI-Driven Exploit Engine<br>(Prompted & architected by Calif)"] H -->|"One day turnaround"| I["Working Remote Exploit<br>(PHP2Shell) Delivered"] end ```
---
`22:42` The Unpatched 2024 Flaw and AI-Engineered Exploits
Upon receiving the report, the PHP Foundation revealed a striking detail: their own maintainers had already discovered the exact same vulnerability back in 2024. However, they had chosen not to patch it because an effective remediation was prohibitively expensive and architecturally fraught. Any patch would have required altering extensive core functionality across the runtime, risking the introduction of fresh security flaws or breaking existing deployments for millions of websites worldwide. Because nobody had demonstrated an actionable exploit at the time, maintainers judged the risk of breaking functional production code higher than the theoretical threat of an unproven flaw. When Calif brought the bug back to their attention, the foundation immediately challenged them with a single prerequisite: provide a working exploit. Within 24 hours, Calif used frontier AI tools to build and return a functional exploit proving that an unauthenticated remote attacker could compromise an arbitrary server.
The hosts clarify that AI was not primarily responsible for finding the bug; human researchers had already uncovered the weakness on multiple occasions over the years. Instead, the true disruption of AI was turning exploit generation into a fast engineering discipline. Because PHP has roughly thirty years of architectural history and accumulated features, a human engineer writing an exploit from scratch would typically have to spend months analyzing memory layouts and internal logic, often abandoning the effort before achieving weaponization. With AI models, researchers simply architect the high-level exploit strategy and prompt the model to implement and validate each stage:
> “The problem was the exploitation, like you said. And for exploitation, like AI plays a major role in it. It becomes an engineering problem where our engineers would tell AI, you know, this is how I want to design our exploit and you go and do it, and then prove to us that it works correctly.”
- PHP was originally created three decades ago, resulting in an exceptionally large codebase that discourages prolonged manual auditing. - Maintainers deliberately left the vulnerability unpatched in 2024 because the breaking changes of a fix outweighed an unverified theoretical exploit. - Calif turned around a fully functional proof-of-concept in approximately one day using AI to automate the implementation.
---
`25:21` Offense vs. Defense: Why Defenders Will Eventually Catch Up
When asked philosophically whether defensive cybersecurity can outpace offensive capabilities in the AI era, Bruce Dang takes an optimistic stance. He argues that defenders can leverage frontier models to rapidly architect, test, and iterate on resilient systems that present far more complex surfaces for attackers to dismantle. Because models excel at reasoning through large datasets and offering immediate engineering feedback, they will increasingly help teams write secure code from inception: “Today, you can use AI to build whatever systems you want very quickly. You can experiment and get feedback very quickly. It can also process data very, very quickly and reason about that data.” Over time, this acceleration in defensive engineering should counterbalance the advantages currently enjoyed by adversaries.
Thai Duong expands on this dynamic by contextualizing it within the broader history of technology. Historically, human advances consistently bring tool weaponization, and malicious actors are almost always the earliest adopters because they operate without structural constraints. Duong observes that while headlines make cybersecurity appear hopeless due to daily reports of breaches, defenders have made massive strides over the past quarter-century:
> “Imagine you have a complex system. Imagine you have a house with lots of doors, lots of ways to get in, and cybersecurity must make sure everything is safe. At the same time, your house or your office must remain open for business. So it's actually a pretty difficult problem. At the same time, without the progress that the industry made in the past 25 years, things could be much worse, right? And I think the same thing would be happening here. It's going to take a while for defenders to catch up. Right now, AI helps attackers more than defenders.”
---
`28:34` Paying Down Technical Debt in a 'Dumpster Fire' Software Ecosystem
The hosts suggest that cybersecurity is currently enduring an awkward transitional phase where attackers use AI to exploit decades of accumulated technical debt—systems left unpatched or un-refactored for years because maintenance was too disruptive. Duong agrees, noting that if society uses AI to aggressively expose these long-standing structural weaknesses, it effectively forces an overdue reduction of global technical debt.
However, Duong shares that auditing codebases with AI has yielded an unsettling revelation. Many core systems that the industry assumed were robust and relatively free of architectural baggage turned out to be fundamentally insecure once subjected to model-driven scrutiny: “We found that there are systems that we thought that don't have a lot of technical debt, that turned out that they just like a dumpster fire like everybody else. That was a very big surprise, right, to me personally.” This realization underscores that simply aiming an AI model at widely trusted software components consistently produces a flood of exploitable zero-day vulnerabilities.
`30:00` The 10x Vulnerability Shock in Hardened Codebases
Security researchers long assumed that heavily audited, high-profile software components would emerge relatively unscathed even when subjected to automated scrutiny. Instead, deploying frontier AI models revealed roughly ten times more bugs than anticipated, shattering long-held assumptions about defensive posture. While uncovering a flaw in PHP surprised no one given the language's historical track record, discovering widespread flaws in hardened software like Google Chrome came as an unsettling shock to industry veterans who had spent years engineering its defenses.
```mermaid flowchart TD accTitle: AI Security Audit Impact accDescr: Diagram contrasting traditional security assumptions against AI-driven discovery results across PHP and Google Chrome.
subgraph Assumptions["Prior Industry Assumptions"] A["PHP: Known for legacy issues"] B["Google Chrome: Heavily invested defense & mitigations"] end
subgraph Discovery["AI Model Audit Results"] C["PHP: Critical exploits like PHP2Shell confirmed"] D["Chrome: Over 1,000 new vulnerabilities surfaced"] end
A --> C B --> D D --> E["Dilemma: Security talent gap vs. unmanageable codebase scale"] ```
Thai Duong reflects on his time working on Chrome security at Google, where the security philosophy focused not just on eradicating vulnerabilities, but on layering mitigations so that flaws could not easily be leveraged into arbitrary code execution or browser takeover. The revelation that thousands of latent flaws existed forced an uncomfortable reckoning. Duong admits: “We thought that the defense layers were pretty good and the rate of vulnerabilities were low. But then after AI, we just discovered that either like we as security engineers suck at our job, we couldn't find this thing, or there's just like too much code that we didn't have enough time to look into.”
- Finding flaws in PHP was expected, but discovering a reported 1,000 vulnerabilities in Google Chrome surprised the entire security industry. - Systems that historically had few vulnerabilities remain the rare exception rather than the norm under frontier model scrutiny. - Browser defense relies heavily on mitigation layers designed to block exploit chains even after memory corruption or logic bugs occur.
---
`31:39` The Limits of Formal Verification and the Nature of Software
Joe Weisenthal raises the question of whether software can be made provably secure—analogous to how mathematicians produce formal mathematical proofs in proof assistants like Lean—such that no future AI could ever locate a valid exploit. Bruce Dang responds that while formal verification exists and can successfully prove small components or microkernel cores mathematically secure, applying it to a modern web browser is practically impossible. A modern browser operates effectively as its own massive, multi-layered operating system spanning many billions of lines of code.
Thai Duong points to the underlying economic engine that made software dominant globally: its malleability and rapid cycle of iteration. Formal verification inherently demands friction and time, running counter to the imperative of software companies to iterate and push updates immediately. Duong explains: “Fundamentally, software is easy to change and people want to change it constantly. And that's the reason why, you know, the tech companies are doing so well. So if you ask, like, 'Okay, now let's not change it frequently,' then that goes against the interest, right? And that's not going to happen.” Unless verification becomes completely automatic, the demand for fast-paced deployment will always outweigh the pursuit of absolute mathematical proof.
- Formal verification is currently constrained to isolated, small components and core operating system abstractions rather than massive application suites. - Web browsers encompass billions of lines of code and function with the complexity of entire operating systems. - Software's primary commercial advantage over physical engineering is speed of revision: products can be fixed or altered overnight.
---
`35:28` Bloomberg Tech Minute and Sponsor Break
During the program break, Carol Masser presents the *Bloomberg Tech Minute* (brought to you by ChatGPT), examining the intense hiring practices at SpaceX based on reporting by Bloomberg Businessweek's Lauren Grush. Landing a role at SpaceX often requires extraordinary technical capability, hands-on experience over academic credentials, and in certain instances personal resume reviews by Elon Musk. Job postings require willingness to work extended hours and weekends to support the mission of interplanetary space exploration, balanced by compensation packages offering equity and vesting restricted stock units (RSUs).
The broadcast continues with commercial messages: - **Chase for Business:** Details on business checking services for more than 7 million clients, featuring a $500 bonus for opening a new Chase Business Complete Checking account with qualifying activities before January 21, 2027. - **Toyota:** Promotion for the "Save Bucks on Trucks" sales event highlighting durability, hauling capability, and off-road performance across the Tacoma and Tundra lineups. - **IBM:** Highlights research showing only 9% of organizations have comprehensive visibility across their technology stack, advocating for IBM’s open hybrid cloud architecture with built-in governance, data sovereignty, and compliance monitoring.
---
`39:40` Rethinking the Vulnerability Waterfall
Returning to the interview, Joe Weisenthal pivots the conversation to how AI affects the end-to-end lifecycle of vulnerability response. Under the traditional cybersecurity paradigm—often structured like a waterfall process—a vulnerability is identified by researchers, the software vendor is alerted under coordinated disclosure, engineers develop and test a patch, an advisory is published, and users downstream scramble to deploy the update before threat actors exploit it in the wild. The hosts and Calif researchers prepare to examine whether frontier AI models will compress or fundamentally break this operational sequence.
`40:00` The Emergence of “Minus One-Day” Vulnerabilities and the Collapsing Patch Window
Traditionally, cybersecurity categorized vulnerabilities into two main buckets: zero-day vulnerabilities, which are unknown to the public and the vendor, and n-day vulnerabilities, which have already been disclosed and potentially patched, leaving a race for users to upgrade before attackers strike. Now, however, the industry faces what Thai Duong describes as “minus one-day” vulnerabilities. This dynamic emerges especially in open-source ecosystems like PHP, where development takes place transparently on platforms like GitHub. The moment security researchers report an issue and maintainers push a public patch or pull request to the repository, that fix is visible to the entire world long before a stable, packaged release reaches downstream end users.
Historically, developing an exploit from a patch diff took significant manual reverse engineering, granting systems administrators a comfortable grace period to deploy updates. In the age of automated reasoning and LLMs, that grace period has effectively vanished. Attackers now operate automated “n-day factories” that constantly crawl commits across critical open-source foundations and proprietary giants alike—including Windows, macOS, PHP, Python, and Java. As soon as an AI detects code alterations indicating a security patch, it consumes tokens to identify the root flaw and synthesize a working exploit in a matter of hours.
```mermaid flowchart TD accTitle: The Collapse of the Vulnerability-to-Exploit Lifecycle accDescr: Diagram showing how AI collapses the window between an open source patch commit and the creation of an active exploit.
subgraph Development ["1. Patch Development"] A["Vulnerability Reported"] --> B["Maintainer Commits Fix to Public Repo"] end
subgraph Exposure ["2. The Minus One-Day Window"] B --> C["Commit Public on GitHub / Open Source"] C --> D["Automated AI 'N-Day Factories' Scrape Diffs"] end
subgraph Exploitation ["3. Weaponization vs. Remediation"] D --> E["AI Generates Exploit in Hours"] B -.->|"Traditional Packaging & Distribution"| F["Packaged Release Reaches End Users"] E -->|"Attacks Launch Before Upgrade"| F end ```
- **Open Source Exposure:** Public repositories allow malicious monitors to weaponize code changes between the time a patch is written and when downstream users actually upgrade. - **Automated Exploitation:** “Now that window is collapsing,” Thai Duong explains. “Because right now, there are people who have what we call an n-day factory, you know, they're just waiting for patches from Microsoft, from Apple, from important critical software.” - **Widespread Surveillance:** Automated agents actively monitor core language repositories (PHP, Python, Java) to seize on commits and quickly generate functional exploits.
---
`43:08` The Sandbox Delusion: Why “Just Fix the Model” Fails
In the wake of incidents involving AI models escaping containment—such as issues observed with Hugging Face—a philosophical divide surfaced in the tech community. On one side stood the anthropomorphic camp, which views frontier models as devious entities constantly searching for escape routes from their digital cages. On the other side stood pragmatists like Nvidia CEO Jensen Huang, who suggested in an interview that labs should simply build stronger sandboxes or train models that refuse to hack. When asked whether securing AI is truly as simple as strengthening sandboxes and patching model behavior, Thai Duong strongly dismisses that view as naive, noting that external observers routinely underestimate enterprise security.
Duong points to a foundational aphorism in cybersecurity: “product security is not the same as security product.” Purchasing enterprise security boxes or firewalls does not guarantee defense, as security products themselves regularly contain exploitable vulnerabilities. The deeper complication lies in business models and economic incentives: frontier AI companies make money by selling tokens, and software engineering is currently the primary commercial use case for those tokens. An AI agent cannot be exceptionally good at programming, debugging systems, and executing terminal commands without simultaneously possessing the core skillset of a hacker.
- **Jensen Huang's Stance:** Advocated a straightforward engineering approach to containment, arguing that labs should simply train models not to hack and avoid shipping unaligned products. - **The Dual-Use Dilemma:** Thai Duong points out that hacking and software engineering rely on identical technical competencies: “If you want to be really good at coding, you need an agent, an AI that understands code, understands technical problems, can debug things, can control computers. But that's basically the definition of a hacker. So you cannot really escape this. You cannot have your cake and eat it too, right?” - **Enterprise Reality:** “People think that, you know, maybe people are not in security. They think that there's a simple solution to cybersecurity. Just do this thing and you're safe. And that's how we have so many problems,” says Duong.
---
`46:12` Hacking in the Age of AI: Reverse Engineering and Exploit Chains
Bruce Dang reflects on the dramatic shift in day-to-day security engineering over the past three to four years. In the past, master-level reverse engineering required painstakingly breaking down compiled binaries and firmware without access to source code or hardware specifications—a discipline so intricate that Dang and his peers spent years writing comprehensive textbooks on the craft. Today, an off-the-shelf AI model can ingest firmware and output equivalent technical analysis in moments. Dang recounts peers running inexpensive five-dollar open-source model queries that autonomously reverse-engineered embedded firmware on Canon and HP printers, discovering vulnerabilities with minimal human guidance.
This leap in capability extends to high-end exploit engineering, such as assembling complete weaponized attack chains against heavily fortified targets like Apple’s iOS. Constructing an iPhone exploit chain once required dedicated, multi-month initiatives led by elite research teams; today, individual practitioners leveraging AI tooling are producing full functional exploit chains in a matter of days. As a result, the economics of offensive security have inverted, leaving defenders—particularly in vulnerable sectors like global finance and banking—racing to keep up as threat actors integrate generative models directly into operational attack workflows.
- **Democratized Reverse Engineering:** Dang notes that material that previously took years to document in textbooks can now be synthesized on demand, citing a colleague who used a $5 open-source model run to reverse engineer and exploit commercial printer firmware. - **Evolving Tradecraft:** Dang references industry veteran Matt Suiche, who demonstrated running AI-driven offensive hardware setups directly out of a residential apartment rack. - **Speeding Up iOS Chains:** “To build a full chain on the iPhone, it's not an easy task. It sometimes it takes people, you know, like months or a whole team to do it. But now people can do it in like a few days, you know, as a one person,” Dang notes regarding the pace of development. - **Defensive Pressure:** Financial institutions and enterprise banks are already encountering AI-accelerated attacks, where defenders struggle to counter exploit generation speeds that outmatch traditional incident response cycles.
`50:00` Machine-Speed Infiltration and the Collapse of Legacy Defenses
Thai Duong describes a startling shift in how cyber incidents unfold when powered by frontier AI models and massive compute. On the OpenAI side, security teams reported that while they have dealt with numerous incidents over time, they recently encountered an intrusion where roughly one hundred distinct points across their internal networks were breached simultaneously. In a traditional corporate breach, a blue team typically hunts for one or two human attackers moving methodically through the environment. Facing a hundred automated agents operating concurrently inside the perimeter represents an entirely different operational reality, likely enabled by large token allowances that allow agents to probe and exploit everything at scale.
This dynamic became even clearer just two weeks prior, when Calif was called in to perform incident response for two separate commercial banking clients that had suffered network intrusions. Drawing on Calif's own red-teaming background, Thai explains that when human security professionals compromise an enterprise network, it typically takes up to a month of manual reconnaissance, privilege escalation, and lateral movement to establish a broad foothold. In the case of these AI-driven incursions, the attackers breached the perimeter on a Monday, and by Tuesday morning they were across the entire infrastructure. Thai emphasizes how this machine-speed propagation shatters existing security orthodoxy:
> “For the AI took like they came in, they broke the net, they broke inside the network on Monday by Tuesday, they're everywhere.”
This blistering speed exposes fundamental flaws in conventional enterprise defense strategies. For decades, cybersecurity vendors and consultants advised corporate clients to prioritize visibility and intrusion detection above all else. Yet receiving an automated alert stating that one hundred coordinated agents are currently traversing your core systems provides little practical help to incident responders. Because financial institutions cannot simply power down critical transaction rails and core banking databases to halt an ongoing lateral spread, Thai points out that the industry is forced to reconsider its entire playbook:
> “What we have right now is not working very well.”
```mermaid flowchart TD accTitle: Lateral Movement Timelines: Human vs. AI Hackers accDescr: Flowchart comparing lateral movement speed between human penetration testers and AI-driven automated attacks inside enterprise networks. subgraph Human["Human Penetration Timeline"] H1["Perimeter Breach"] --> H2["Manual Reconnaissance"] --> H3["Lateral Foothold Across Network<br/>(~1 Month)"] end subgraph AI["Machine-Speed AI Timeline"] A1["Perimeter Breach<br/>(Monday)"] --> A2["Automated Mass-Parallel Probing<br/>(100 Coordinated Agents)"] --> A3["Ubiquitous Foothold<br/>(Tuesday)"] end ```
- Traditional incident response assumes a blue team is hunting one or two human operators who require weeks to manually map and pivot through a network. - High-compute threat agents deployed against enterprise environments leverage parallel reasoning to move through complex infrastructures in under 24 hours. - Standard remediation tactics (such as total network isolation or operational shutdowns) remain completely unviable for mission-critical infrastructure like tier-one banks.
---
`51:45` The Centaur Era: From Deep Blue and AlphaGo to AI-Assisted Hackers
Reflecting on how it feels as a veteran offensive security researcher to witness machines automating exploit development, Thai looks to the history of competitive game-playing engines for precedent. In 1997, IBM's Deep Blue defeated World Chess Champion Garry Kasparov, but Deep Blue was a custom, warehouse-scale mainframe rather than everyday software. It took an entire decade before commodity software running on standard personal computers could reliably beat elite human grandmasters. During that ten-year interim, the highest level of competitive chess was dominated by what Kasparov famously termed "centaur players"—a hybrid collaboration combining human strategic intuition with computer tactical calculation. By contrast, when Google DeepMind's AlphaGo defeated Lee Sedol in 2016, that transitional window compressed drastically: within just three years, fully autonomous systems were thrashing world-class human Go champions without any human intervention whatsoever.
Thai argues that offensive cybersecurity has now entered its own transitional centaur phase. Today's frontier AI models possess immense power to find vulnerabilities and generate exploit payloads, but they still rely on elite human hackers to direct their attention, contextualize complex architectures, and bridge reasoning gaps. However, nobody knows whether this cybersecurity centaur era will last three years or collapse within three months:
> “At Calif, we think we are in the era of the centaur hackers.”
Thai rejects an outright pessimistic perspective that reduces AI's emergence to inevitable career obsolescence. Instead, he compares artificial intelligence to humanity's original discovery of fire—a foundational, inherently dangerous tool that catalyzed human evolution. While society must develop rigorous safeguards to contain and control the fire, researchers must also figure out how to harness it constructively. When Thai asks, "What should we cook?", Joe Weisenthal jokes that humanity should cook protein so our brains can grow even larger, before thanking both Thai Duong and Bruce Dang for detailing their research on the front lines of machine-speed vulnerabilities.
- Garry Kasparov's defeat by IBM Deep Blue in 1997 kicked off a ten-year era of human-computer "centaur" chess superiority before standalone desktop engines took over entirely. - AlphaGo's 2016 victory over Lee Sedol compressed that cycle down to three years, after which purely automated systems surpassed all human-in-the-loop play. - Calif assesses that current state-of-the-art offensive capability sits squarely in this hybrid centaur zone, where top human researchers leveraging LLMs vastly outperform either humans or autonomous models working in isolation.
---
`54:40` Post-Interview Debrief: The Fleeting Window and the Coding Paradox
Following the interview, hosts Joe Weisenthal and Tracy Alloway break down the sobering implications of Calif's discoveries. Tracy notes that the conversation was far from uplifting. She had originally assumed the current wave of vulnerability discovery was simply an awkward, temporary phase: AI models uncovering latent legacy bugs from the past thirty years, which would soon be remedied once AI was deployed to architect new, mathematically provable, and resilient codebases. However, the sheer gargantuan scale of modern software—such as web browsers containing tens of millions of lines of interconnected code—makes complete automated formal verification largely impractical for anything beyond tiny, isolated programs.
Joe focuses on the brevity of the current technological window and the fundamental paradox at the heart of AI alignment. While the concept of a hybrid "centaur" hacker acting as an interim balance of power is intellectually appealing, the historical trajectory from chess to Go suggests that the hybrid window could shut in a matter of months or a single year. Furthermore, Joe dismantles the common naive reaction that model developers should simply "teach AI not to hack":
> “If coding is going to be big business, which it is, you're going to be building a lot of good hackers.”
Because software engineering and autonomous coding assistants represent one of the most lucrative commercial verticals in the entire AI industry, frontier model builders are heavily incentivized to train models that excel at deep syntax analysis, logical troubleshooting, and execution flow tracing. By training models to understand software at that fundamental level, developers inherently and unavoidably build world-class vulnerability research engines, guaranteeing that offensive cyber capabilities will proliferate alongside everyday developer tools.
- Massive legacy consumer software targets—such as web browsers—remain far too expansive and complex for automated formal verification to guarantee end-to-end security. - The dual-use nature of machine intelligence means that commercially optimizing LLMs for general programming directly creates proficient, machine-speed offensive hackers. - The hosts close the episode by highlighting Odd Lots production credits (Carmen Rodriguez, Dashiell Bennett, Kale Brooks, and Kevin Lozano), inviting listeners to join the 24/7 discussion on the Odd Lots Discord community, and recommending the daily Bloomberg newsletter.
## Notable quotes > `25:21` It's going to take a while for defenders to catch up. Right now, AI helps attackers more than defenders. — Thai Duong
> `54:40` If coding is going to be big business, which it is, you're going to be building a lot of good hackers. — Joe Weisenthal
## Mentioned PHP2Shell, PHP, Calif, Thai Duong, Bruce Dang, Ryan Austin, Stefan Esser, Volker Dusch, Tracy Alloway, Joe Weisenthal, Carol Masser, Lauren Grush, Elon Musk, SpaceX, Anthropic, Mythos, Project Glasswing, Wiz, OpenAI, Microsoft, MSRC, Apple, iOS, Google, Google Chrome, Gmail, Netscape, Jensen Huang, Nvidia, Hugging Face, Canon, HP, Matt Suiche, IBM, Deep Blue, Garry Kasparov, Google DeepMind, AlphaGo, Lee Sedol, Chase for Business, Toyota, Barclays, Delta SkyMiles, American Express, Python, Java, Lean, Odd Lots
## Video description <p data-prosemirror-content-type="node" data-prosemirror-node-name="paragraph" data-prosemirror-node-block="true" data-pm-slice="1 1 []">Earlier this year, cybersecurity researchers discovered a vulnerability in PHP, an open-source coding language used in roughly 70% of the world's websites, that had been lying dormant for a long time, and if exploited, could have led to disaster. And the researchers only understood the extent of this bug through the use of frontier AI models. Today, we talk to two staffers at Calif (CEO Thai Duong and engineer Bruce Dang), the cybersecurity firm that was among the first to discover the PHP vulnerability. Their firm partners with the major AI labs and neoclouds, and they help these companies test models and look for vulnerabilities in their infrastructure. Duong and Dang tell us how Calif uncovered the PHP hack, what the firm exactly sells, and what the future of cybersecurity looks like in the age of AI.</p> <p data-prosemirror-content-type="node" data-prosemirror-node-name="paragraph" data-prosemirror-node-block="true">Read more:<br data-prosemirror-content-type="node" data-prosemirror-node-name="hardBreak" data-prosemirror-node-inline="true"><a href="https://www.bloomberg.com/news/articles/2026-10-29/ai-and-cybersecurity-why-cyberattacks-are-getting-harder-to-stop?utm_medium=referral&utm_source=podcast&utm_campaign=odd_lots&utm_content=article" data-prosemirror-content-type="mark" data-prosemirror-mark-name="link">How AI Is Making Cyberattacks a Bigger Threat</a><br data-prosemirror-content-type="node" data-prosemirror-node-name="hardBreak" data-prosemirror-node-inline="true"><a href="https://www.bloomberg.com/news/articles/2026-10-29/japan-s-cyberattack-surge-tests-its-push-to-strengthen-defenses?utm_medium=referral&utm_source=podcast&utm_campaign=odd_lots&utm_content=article" data-prosemirror-content-type="mark" data-prosemirror-mark-name="link">Japan’s Cyberattack Surge Tests Its Push to Strengthen Defenses</a></p> <p data-prosemirror-content-type="node" data-prosemirror-node-name="paragraph" data-prosemirror-node-block="true">Only <a href="http://Bloomberg.com" data-inline-card="" data-card-data="">http://Bloomberg.com</a> subscribers can get the Odd Lots newsletter in their inbox each week, plus unlimited access to the site and app. Subscribe at <a href="https://www.bloomberg.com/subscriptions/oddlots?in_source=oddlotspodcast" data-prosemirror-content-type="mark" data-prosemirror-mark-name="link">bloomberg.com/subscriptions/oddlots</a></p> <p data-prosemirror-content-type="node" data-prosemirror-node-name="paragraph" data-prosemirror-node-block="true"><a href="http://bloomberg.com/subscriptions/oddlots" data-prosemirror-content-type="mark" data-prosemirror-mark-name="link">Subscribe to the Odd Lots Newsletter</a><br data-prosemirror-content-type="node" data-prosemirror-node-name="hardBreak" data-prosemirror-node-inline="true"><strong data-prosemirror-content-type="mark" data-prosemirror-mark-name="strong">Join the conversation:</strong> <a href="https://discord.gg/oddlots" data-prosemirror-content-type="mark" data-prosemirror-mark-name="link">discord.gg/oddlots</a></p><p>See <a href="https://omnystudio.com/listener">omnystudio.com/listener</a> for privacy information.</p>
[Source](https://podtrac.com/pts/redirect.mp3/tracking.swap.fm/track/UVBrz8bN8aM2Xe47PEPu/traffic.omny.fm/d/clips/e73c998e-6e60-432f-8610-ae210140c5b1/8a94442e-5a74-4fa2-8b8d-ae27003a8d6b/cbaad2bb-14e3-4e9e-98cf-b4f2015679b2/audio.mp3?in_playlist=982f5071-765c-403d-969d-ae27003a8d83)