AI Sovereignty & Cybersecurity with Dr. David Bray

happened there? Yeah, keeping it at the high levels, but I think it would be safe to say two events happened in the world that people can look at and presume there's other things happening too, which is one, we have seen an onrush of increasing cyber attacks and ransomware attacks impacting Japan.

And it's unprecedented, the number.

And we can actually then talk about what's happening this week as well.

And then similarly, folks may be tracking open source report about France as well, that France has also had an onrush even to the level of refrigerators being compromised, which causes the food and then to spoil and having to throw this out.

And this is on top of the already existing problematic scenario that France is experiencing, which is they've got some riots and some protests over the budget and education and the like.

So it seems like, and the reason why I got pulled in last week and why I apologize that I couldn't make the conversation we did have scheduled, it's very timely because it seems like now world governments around the world are having to figure out now that these AI tools are available and not just through the frontier models and the private companies.

But increasingly, open-weight AI models can be used to do this as well.

How do you deal with the onslaught of cybersecurity vulnerabilities and keep up the pace? Because the challenge is an attacker using these tools doesn't have to care about breaking things or if things don't work.

Whereas defenders, they have to both push back the attacker, but also keep the lights on, keeping things running.

And it seems like at least for the next two to three years, things are going to get harder before they get better.

And then the other timely item, which most people here may have heard of, is the PHP vulnerability.

There was, I believe, also Node.js vulnerability yesterday that was announced yesterday that's been around for years, that's been exploited with a lot of people in IT and across the web scrambling for patches.

Do you have any perspective color on that outside of what we maybe are seeing in the news?

Yeah, so I think...

So without saying the specific entity, I got pulled into some of these conversations in March when it was clear that the frontier labs that were doing AI had technologies that were essentially really good vulnerability scanners.

And I got pulled into these conversations because, again, I'm a nonpartisan.

So both sides of the aisle might ask my opinion some of the times and then shoot at me also.

And so you just have to be OK with that.

And the March conversations were what to do.

And I think.

again, like all things, some people were looking for some old playbooks that we'd either make this limited access, possibly classify it, which of course wouldn't work, especially for private companies, or somehow we thought we could contain it.

And I was really puzzled by this because I was like, again, these tools are going to get out there, whether from the actual companies that are producing them and selling them.

But we know also that there are increasingly numbers of what's called open-weight AI, some of which that are legitimately produced, some of which are a result of what's called distilling.

And so distilling is when an actor, either with permission or without permission, distills the key insights from a trained frontier model.

But basically it is 95% as capable of But it needs much less compute.