Glonce

Alex Stamos says open-weight AI models are upending cybersecurity

securityThe Glonce editorsThe Verge🔥49Glonce rating49Impact40Novelty30Relevance85Surprise30Players35Credibility60
Alex Stamos says open-weight AI models are upending cybersecurity

The Verge's Decoder podcast interviewed Alex Stamos, chief security officer at Cognition, longtime cybersecurity expert and lecturer at the Stanford University Cyber Policy Center, about what he sees as a mess in cybersecurity. The episode opens a special series on AI in real life. The host's introduction says private actors and state actors, such as Russia or North Korea, are breaking into systems thanks to AI that helps them detect and exploit vulnerabilities at the same time. Stamos is described as no doomer in the long run, but as expecting a 'dark age' while people work out how to adapt.

Stamos says October, traditionally security awareness month, brought a couple of big bugs (he names PHP and Node) and, less discussed, a huge number of breached companies. He lists a run of AI-related 'neocloud' companies breached in succession, the Binance hack, which he calls the largest heist of anything in human history, and the Cursor incident. His point is that the hacks are being chained together. Framing it 'from what we know right now', he says Fireworks, a prominent provider of AI services to a number of companies, was broken into; API keys stolen there let attackers into Cursor; and once inside Cursor they pushed a bad plugin that went to 5,000 more companies, causing what he calls 5,000 potential breaches. He describes a 'permanent continuous breach' across the tech industry. A CISO friend asked a group of them, 'Is anybody else tired?', and everyone said yes, because defenders have effectively been at DEFCON 2 for all of October and into November.

Asked who is behind it, Stamos says it is a variety of different groups. His explanation is capability, not a change of intent: 'we are at the start of the takeoff of adversary capability enabled by AI', because open-weight models have reached the point where most of the kill chain can be automated. He defines the kill chain as the steps you take to have an effect on a target, such as stealing information, turning something off or stealing money or Bitcoin. Traditionally attackers did research up front, found a vulnerability, wrote exploits well ahead of time, and then had a human deploy them against one target or against hundreds or thousands. Now, he says, the chain has inverted: an AI system can 'go hog wild', looking at targets, finding bugs and writing exploits in real time, and break into the companies.

The tool everyone is talking about, he says, is ARTEX, a Chinese open-source tool with an English translation on GitHub. Powered on the back end by something like an 'obliterated' GLM-5.3, it will let you break into a shocking number of organizations. The wave started with three South Korean banks, and about 200 more companies were hit this week. Stamos says Cognition is not an incident response company but helps people fix their bugs afterwards with its tools, and he finds it shocking that companies are being hit by something you can simply download. He compares it to the 1990s and the late-'90s Windows security disaster. In the early DEFCONs a couple of hundred people met in one room, most of them good guys, whereas DEFCON now draws roughly 40,000 to 60,000. Back then the world did not run on the internet; now it does, and attacks can be automated. He adds that attackers no longer have to use frontier models, which have protections and logs available to law enforcement. He has been running a quantized obliterated GLM-5.3 on his own new Mac, and says what it can do is incredible.

The host raises the old economics of defense: paying skilled people to defend instead of attack, bug bounties, disclosure etiquette, transparency reports. Stamos replies that the last era began with Bill Gates's 'trustworthy computing' memo in the early 2000s, when Microsoft, Oracle and later Amazon and Salesforce hired ex-hackers, and responsible disclosure, bug bounties, consultancies such as Foundstone, @stake, Mandiant and CrowdStrike, and the RSA and Black Hat industry followed. That multi-billion dollar industry grew up in the 2000s and 2010s, and he says that era is over because it rested on a few assumptions. First, a hierarchy of skill: script kiddies at the bottom, tool writers above them, then vulnerability researchers, then a 'god tier' in the hundreds of people who could do top-level vulnerability research and write great shellcode. Second, a limited number of people could be operational in an attack, so state teams such as U.S. Cyber Command, Russia's SVR and China's MSS, and later Russian ransomware actors, kept a small elite R&D group and a larger operational one, which took a conspiracy of people. Third, attackers needed people who could launder money, and Bitcoin meant nerds could launder money. AI, he says, is now eroding the skill hierarchy: script kiddies get a good part of the skills of the top researchers. The available text ends there, mid-sentence.

Key facts

  • Alex Stamos, chief security officer at Cognition, says October brought a run of chained breaches: neocloud companies, the Binance hack (which he calls the largest heist of anything in human history) and the Cursor incident.
  • His account of the chain, framed 'from what we know right now': API keys stolen in the Fireworks hack allowed access to Cursor, where attackers pushed a bad plugin to 5,000 more companies, which he counts as 5,000 potential breaches.
  • He says open-weight models can now automate most of the kill chain; an AI system can find bugs and write exploits in real time. He names ARTEX, a Chinese open-source tool, run with something like an obliterated GLM-5.3.
  • ARTEX-based attacks started with three South Korean banks, and about 200 more companies were hit in the week of the interview, per Stamos.
  • Stamos argues the security industry built in the 2000s and 2010s rested on assumptions (a skill hierarchy, limited operators, hard money laundering) that AI and Bitcoin are breaking.

Why it matters

This is a first-hand, if opinionated, account from a working security chief of what AI-assisted attacks look like in practice. Stamos's central claim is that the change is about capability, not intent: open-weight models let attackers automate most of the kill chain, finding bugs and writing exploits in real time instead of preparing them in advance. He ties this to a broader argument that the industry built after Microsoft's 'trustworthy computing' memo in the early 2000s depended on scarce skills, limited operators and hard-to-launder money, and that all three assumptions are failing. He compares the moment to the 1990s, when tools anyone could get did crazy things, but with a world that now runs on the internet.

Who it affects

Companies of any size that are targets of a freely downloadable tool; Stamos says multi-billion dollar companies are being hit. Specific victims he names or describes are AI infrastructure providers (the neoclouds, Fireworks), Cursor and the roughly 5,000 companies that received its bad plugin, Binance, and three South Korean banks. It also affects the security industry itself: consultancies, bug bounty programs and the culture of responsible disclosure that grew up around the old skill hierarchy. Law enforcement comes up too, because attackers using local open-weight models avoid frontier-model protections and logs available to law enforcement.

How to use it

This is a podcast episode, not a product. Decoder publishes new episodes every Monday and Thursday on YouTube, and Verge subscribers get an ad-free feed. As a reading aid, it is useful for the framing Stamos offers: the old kill chain (research, vulnerability, exploit, human deployment) versus the inverted one where an AI system does all of it live. The one practical detail on his own work: Cognition is not an incident response company, but it helps companies fix their bugs after an incident using its tools. The traditional October advice he mentions (change your password, use multiple passwords, use a password manager) is the baseline he contrasts with the scale of what happened.

How solid is it

This is an interview, so everything is Stamos's account and opinion, lightly edited by the publication for length and clarity. His Fireworks-to-Cursor chain is explicitly hedged with 'from what we know right now', and no statements from Fireworks, Cursor or Binance are quoted. The 5,000 figure is described as potential breaches, not confirmed ones, and the 'about 200' companies is his approximation. He gives no dollar amount for the Binance hack and no CVE details for the PHP and Node bugs. He does not name a state or group behind the attacks, saying only that it is a variety of groups. Only part of the interview is available here; it ends mid-sentence, so the later discussion, including the social-media misinformation and slop topic mentioned in the introduction, is not covered.

Risks and caveats

The 'dark age' framing is Stamos's expectation as relayed in the introduction; he is described as not a doomer in the long run. Treat the breach chain and the size of the wave as one security executive's account rather than confirmed incident reports. The claims about what an obliterated GLM-5.3 or ARTEX can do rest on his description and his own testing on a Mac, not on published measurements. His 'DEFCON 2' remark is a figure of speech for how defenders have felt, not a formal alert level. The introduction's mention of Russia and North Korea is the host's framing; Stamos himself, asked directly, did not point to any one actor.

“we are at the start of the takeoff of adversary capability enabled by AI”

— Alex Stamos, chief security officer at Cognition, on The Verge's Decoder