Fireside Chat, Interview, Other
Oege De Moor (XBOW) & Apoorv Agrawal (Altimeter): Hackers with GPUs Offensive Security in the AI Era
- Expo Mission and Capability: Expo is deploying an autonomous AI agent designed to function as an AI-powered hacker, which autonomously explores web applications, crafts exploits, and generates vulnerability reports based solely on a target URL and optional credentials.
- Performance Benchmarking: On the HackerOne platform, Expo has ranked as the #1 ethical hacker globally for the past quarter, surpassing all human experts to accumulate approximately 1,200 verified vulnerabilities in a single week.
- Critical Zero-Day Findings: The agent has successfully identified and published deep-seated vulnerabilities previously missed by thousands of human testers, including:
- A Zero Day in Palo Alto Networks' Global Protect, used by thousands of enterprises.
- Critical vulnerabilities in Akamai's CloudTest product.
- A long-standing vulnerability in a critical Salesforce component that remained undetected for years.
- Adversarial Threat Landscape: Uhey Dhimur warns that the "skill shortage" for malicious actors has been eliminated by AI, allowing adversarial nation-states and criminal organizations to automate attacks with unprecedented speed and frequency using tools like Expo.
- Code Generation Impact: The widespread adoption of AI coding tools (including Dhimur's previous work on GitHub Copilot) has increased vulnerability rates as non-engineers utilize "vibe coding," compounding the threat posed by automated adversarial attacks.
- Timeline for Catastrophe: Dhimur forecasts a major, unexpected AI-powered cyber incident within the next 12 months, driven by the exponential rise in automation and the industry's unpreparedness for the speed of AI-driven exploitation.
- Market Shift and Defense Strategy: The cybersecurity industry is entering a period of "chaos" where defenders must "fight fire with fire" by deploying autonomous AI agents like Expo to find and patch vulnerabilities before malicious actors do; long-term stability is expected only once defenders fully leverage these tools.
- Investment Thesis: Altimeter Capital invested in Expo based on the convergence of rising cyber attacks, increased AI-generated code vulnerabilities, and the necessity for AI-driven defense to reduce CISO alert fatigue and time-to-detection.
- Future of Penetration Testing: While the technical execution of penetration testing will become fully autonomous and superhuman within a year, the role of human security professionals will shift toward strategic orchestration, defining targets, and setting business logic rules for AI agents.
- Detection Heuristics: Dhimur notes that bad actors are already using AI, evidenced by the reduction in the time between security patch publication and system exploitation from weeks to less than a few hours.
- AI Bullishness (Long Position): Dhimur expresses strong optimism for:
- Personalized Education: AI-driven tutorials that replicate the high-effectiveness of Oxford's one-on-one teaching model globally.
- Replit: Valued not just for code generation but for its ecosystem that lowers the barrier to entry for non-engineers to build and deploy applications.
- Suno: The music generation platform, which Dhimur describes as "completely wild" for its ability to generate lyrics and music from text descriptions.
- AI Bearishness (Short Position): Dhimur is skeptical of the current state of general code generation for full-system architecture, arguing that:
- AI currently excels only at syntax translation and small scripts, not the creative, high-level architectural decision-making that defines complex software engineering.
- Swarms of cooperating agents do not fundamentally alter the difficulty of high-level system design compared to single agents.
- The "hallucination" feature of AI is a distinct advantage for security testing (allowing agents to try unexpected attack vectors like JSON content types) but remains a liability for reliable code architecture.
- Mechanism for Discovery: Expo utilizes a "hallucination as a feature" strategy, where the AI generates and tests unexpected hypotheses (e.g., unusual content types) that human testers typically overlook, thereby uncovering obscure vulnerabilities.