PHP2Shell Won't Be the Last Big AI Cybersecurity Risk

Thai Duong · Calif

The window between a vulnerability's disclosure and its exploitation is collapsing across all operating systems and software.

Previously attackers had to wait for a patch to be released and then needed a long time to develop an exploit, which gave users time to upgrade. Duong argues that AI is collapsing that window. Attackers, including companies watching PHP, Python, Java and critical software from Microsoft and Apple, now have AI agents that burn tokens to identify a new vulnerability, reproduce it and exploit it quickly. He says the collapse applies to Windows, Mac OS and anything else, not just PHP.

“Now that window is collapsing. ... It is collapsing everywhere, not just in PHP. Right? In Windows, in Mac OS, in anything.”at 39:28

Thai Duong · Calif

Security products promised as simple fixes do not make enterprises safe, because the products themselves have flaws.

Duong says that enterprise security is very complicated, and that vendors who sell a single magic box to be installed on the network are misleading customers. He cites the security principle that product security is not the same as security product: even the firewalls people buy may have vulnerabilities, and they do. He argues that the fix is not a simple purchase.

“Vendors go out and tell people, just buy this box, this magic box and put it in your network and you'll be safe. No, it's not like that. Even that box has problems.”at 41:56

Bruce Dang · Calif

AI has made Dang's reverse-engineering textbook obsolete, since one prompt now generates equivalent material.

Dang co-wrote a textbook on reverse engineering, a practice that used to require long manual work to understand binary software without source code. About nine months ago AI reached the point where one or two prompts could generate a comparable textbook, which he says is even better than the one his team spent a long time writing. He backs this with specialist friends who report that a few dollars of open-source model usage can reverse-engineer printer firmware, work that previously took months.

“With the advent of AI... nine months ago, that entire book is deprecating. Takes two prompts or one prompt and then bam, it would generate the textbook for you and it's even better.”at 44:57

Bruce Dang · Calif

AI has cut the time to build a full iPhone exploit chain from a multi-person effort to a few days for one person.

Building a full exploit chain for an iPhone is hard and has often taken several people. Dang says his team built one within a few days as a single person, and that they have multiple such chains. He concludes that the time to build exploits is being compressed sharply.

“To build a full chain on the iPhone, it's not an easy task. Sometimes it takes several people to do this. ... our team was able to do this within a few days.”at 46:25

Thai Duong · Calif

AI-driven intrusions now spread through bank networks in days rather than the month manual attackers needed.

Duong's firm was called in by two banking clients who had been hacked about two weeks earlier. Previously, once his team got into a network, it took about a month to spread through it. In this AI-assisted intrusion, the attackers got inside on Monday and were everywhere by Tuesday. He describes the spread as happening at machine speed, which he presents as evidence that AI has compressed attack timelines for enterprises.

“For the AI, it took... They came in. They brought inside the network on Monday. By Tuesday, they're everywhere.”at 48:20

Thai Duong · Calif

Detection alone cannot keep up with AI attacks, so defensive architectures for banks must be redesigned.

Duong's past advice to clients was to invest in detection. That fails when the network is compromised by many attackers at once: detecting one hacker is not useful when there are a hundred, and banks cannot simply shut everything down. He concludes that the approach needs to be rethought from the ground up, and says that what organisations have right now is not working very well.

“If you see it, you can detect it, but there's a 100 of them. ... What we have right now is not working very well.”at 48:42

Thai Duong · Calif

The strongest hackers now combine AI and human experts, but the human role may not last long.

Duong draws an analogy to chess and Go, where the best player was a human-computer combination for about ten years after Deep Blue and about three years after AlphaGo. He says the best hacker today is a combination of AI and humans. AI can hack anything, but it still needs a human expert. He is unsure how long that will last, from three months to three years. Once the human role disappears, he expects AI to do everything.

“Basically, the best hacker right now is a combination of AI and humans. ... AI is powerful. It can hack anything, but it still require human expert to arrive at.”at 50:39

Thai Duong · Calif

Models cannot be trained not to hack while still automating knowledge work, so the 'just fix the model' fix is unrealistic.

Duong argues that good coding requires an AI agent that understands code, debugs technical problems and controls computers, which is effectively the definition of a hacker. Coding is where most AI tokens are sold, so AI companies are incentivised to build it. Focusing on scientific discovery or physical AI could avoid the problem, but any AI that automates knowledge work must be able to use and control a computer. That makes hacking capability unavoidable, so the proposed fix of training models not to hack is not realistic.

“As long as you want to automate knowledge work... your AI must be able to use computer and control computer, understand technical problems. ... So it's unavoidable.”at 44:02