AI swarms and cyber alarms.

Selena Larson: Hello and welcome to your mandatory cybersecurity awareness training video.

Dave Bittner: In the next few minutes, we'll review simple actions you can take to help protect your organization.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Please pay close attention. Your participation is required.

 

Selena Larson: Rule number one, always be cautious with unexpected messages.

 

Dave Bittner: If a message seems unusual, do not engage with it.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Report suspicious activity using approved channels. Are you kidding me? Who doesn't know that already?

 

Selena Larson: Great job staying alert!

 

David Moulton: We literally read that in the first paragraph of every handbook.

 

Selena Larson: Rule number two, only install software that has been approved by your organization.

 

Dave Bittner: Unapproved tools may introduce security risks.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Always follow internal guidelines before downloading files. Are we seriously explaining this out loud?

 

Selena Larson: Remember, making safe choices protects everyone.

 

Dave Bittner: Rule number three, if something behaves unexpectedly, report it promptly.

 

Selena Larson: Do not attempt to resolve any security issues yourself.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: It's like we're totally insulting everyone's intelligence.

 

Dave Bittner: Because we are.

 

Selena Larson: Thank you for completing this mandatory training video. We hope this corporate training helped. If you follow all the rules listed above -- >> [In unison] You too can stay cyber safe in the real world.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Seriously, people should know this already. [ Music ]

 

Selena Larson: Hello everybody and thank you for tuning in to "Only Malware in the Building." I am here as always with Dave and Keith and today, we're talking about something that nobody is talking about: artificial intelligence.

 

Dave Bittner: I'm sorry, what? Artificial what? I don't think I've heard of that.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Me neither.

 

Selena Larson: Are you familiar with large language models?

 

Dave Bittner: Hmm. It rings a bell but, I -- I -- it's not as if it's been the top subject in my professional career for the past two or three years and I have to talk about it every day.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Surprisingly though, you know, we have not talked about this at least for the last year on our -- on our channel here. So, so -- we -- even though it's out there, we haven't addressed it. So, I think everybody needs to know our positions on AI for sure. Right?

 

Dave Bittner: Okay, sure. Sure.

 

Selena Larson: I think you're right. I mean, we have mentioned it a few times, but I feel like the last few weeks have just been just an absolute waterfall of AI news. And I've been having so many conversations about it outside of my technical network. So, I've had conversations with my friend who is an educator who's like, "Oh my gosh, my high school students, this is terrible." I have had a conversation with my older relatives when I came for a visit. They said, "Please, get this AI out of my email. It's summarizing everything and it's doing it incorrectly."

 

Dave Bittner: Right. Make it stop.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: It's getting turned on like to by default on everything. You know, you're -- just I mean, just even at work, we just had a meeting about that because we're a Google shop. You know, you have Gemini wanting to transcribe your calls and your, you know, your meetings and all that. We're like, "No, we do not. We do not want that." But -- but a lot of this is getting defaulted and you know, people are using it and they just don't even know it. So, I -- I think, you know, there -- there's a lot of things I think that we need to unpack here, just, you know, from things that we're seeing in the -- in the news to proper use of AI to, you know, comparisons with some things. I -- I see what were -- some of these attacks that we're seeing are just kind of reliving, you know, they say, you know, history repeats itself. And it's so reminiscent of the early internet days of like the late 90s and early 2000s with the -- the same mistakes that are happening. So -- so, I think we will have a topic rich episode today.

 

Dave Bittner: There's certainly no shortage of things to opine about when it comes to AI. So, Selena, where do you suggest we begin? Where was a good starting point for us here today? [ Music ]

 

Selena Larson: Well, I think one of the things that we could talk about is how we are actually seeing AI used in attack chains, whether or not it's doing anything. And is this what we were expecting to see? So, Dave and I, we've -- we've chatted about this and we just published some research on a malware called Trust Connect. It was using an AI generated website that was actually vibe coded terribly. It didn't really work. We've seen malware that is written using AI that clearly shows that the developer doesn't actually know what they're doing. We've seen malware that is written by what we would consider to be fairly good malware developers, just faster, better, getting iterated a lot faster. And then of course we've seen every script under the sun written as AI enabled scripting. Social engineering has changed a lot, whether that's creating emails or website landing pages or lures. But, from my perspective, and I'm curious what you guys think, from my perspective, and this is, again, Selena's opinion, it doesn't really matter if something is AI enabled or not, because the defense -- defenders also have AI. We all have it. We're all doing the same stuff. We're all trying the same things. We're all tracking what each other is doing and making changes to account for it. So, it's changing things, but not a absolute groundbreaking, watershed moment. I don't know, Keith, what do you think?

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: I -- I think on -- on whole I agree with you. There are -- there are a couple of things that is starting to make me change my belief on things. One thing, CrowdStrike just came out with a report just a couple of weeks ago, and they compared the breakout times from 2024 to 2025. And so, now with AI, you know, getting more implementation really in the last year that we've been seeing hackers use, the breakout times actually dropped 65% in the last year to now the average breakout time for an attacker is 29 minutes. So, we're seeing, you know, the attackers automate things a little bit more. And the other thing that's really changed my thought process on a lot of things is the recent Fortinet attacks. I don't know if you read up on that, but it was just a fascinating case study to read. And if you haven't heard about that, it -- it was hackers were attacking Fortinet firewalls and they -- it was basically an AI driven attack. So, they generated their structured attack plans first using AI. So, they had step-by-step methodology. They prioritized their task lists. They estimated their timelines. And then they used the -- the tool development like you were just kind of talking about. So, they built, you know, Python and Go tools. They scripted for scanning and exposed interfaces. So, that whole attack chain was AI driven and then they automated the analysis. So, all the stuff that they got back, they put it into AI to automate and look at that, you know, parse the configuration dumps, extracted the credentials and really, you know, things that would have taken literally weeks now with AI just really just sped up the process. So -- so, that started me thinking that, okay, well, this was the first attack that we kind of saw that and it's just going to be -- I -- I think we're going to see a lot more of this. And -- and just like what you were saying, Selena, I think everybody's going to be using it. And so, now it's kind of that going -- going at each other. So.

 

Selena Larson: Well, so but in that -- in that particular case, it was only going after things that had bad creds, right?

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes. Yes. There were no -- there were no exploits, you know, in -- you know, in this. So, yes.

 

Selena Larson: Yes. So, it was very much like, "Okay, well, they don't actually--." I mean, look, I -- I think that it was interesting to see that they were using it for like their full attack chain and the full process, but it wasn't necessarily something that they had like created a zero day with AI and were going after it. I mean, that -- that attack could have been stopped by practicing best cybersecurity hygiene. And I think it's interesting --

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Absolutely.

 

Selena Larson: -- and -- and you know, definitely something that, of course, like that researchers are going to be aware of and are probably red teamers too, now. But at the same time, the defense sort of remains the same against something like that because they could have done it manually. It would have taken way more time, of course, way more time. But it is just something that is a common technique, made a little bit better by automation.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Absolutely. Yes. It just -- it just speeds the process up so quickly. You know, when I was leading the AMP team at -- at EY, you know, if -- if I was still there, I mean, this is what we -- we would be using AI for all of our attacking pens and penetration testing. You know, I mean, it -- it's just really fascinating, I think. So.

 

Selena Larson: Keith GPT.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes, exactly. [ Music ]

 

Dave Bittner: I mean is it kind of fair to -- to say it's -- it's like a swarm? You know, in other words, instead of a deliberate, intelligent, very smart adversary, you've got now just a swarm of kind of dumb attackers that just keep banging away at you. And you're like if you -- if you whacked a hornet's nest with a broomstick, right? And it's not that any one -- it's not that any one hornet's going to kill you, but if you get the whole swarm at you, that's a tough thing to -- to battle.

 

Selena Larson: I think that's a good analogy. But I also think, though, that like some of those hornets might just be flies. Just that's a variety of bugs, because what we've seen and what I think is really interesting is I talked to my colleagues that do malware reverse engineering, and they are convinced that while we're seeing more clearly AI-generated stuff, the best stuff that we're seeing is still very clearly written and developed by a person. And you can use tooling to make AI tooling to do your job faster and maybe, you know, again, more timely and -- and more rapidly and automate more things. But fundamentally, you're still going to have to like look for bugs in code. You're still going to have to make sure that things work correctly. You know, what might run into is that people are just over-relying on AI to do things. So, it'll kind of be in some cases just sort of flooding the landscape with mediocre stuff, just because people, you know, don't really know what they're doing. Right? Like, in the case of Trust Connect, the web development was terrible. The malware was like, okay, this is like malware written by a, you know, by a malware developer, but like, you're clearly not a web developer. And then you add some holes in there that, you know, made it interesting for researchers to poke at. So, I do -- I do think that it's important to be aware of it and know how threat actors are using it and -- and know what -- like what's emerging. But again, I don't -- I don't necessarily think it's going to be giving everyone a stinger.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes, I think one of the things is that, because everybody's still trying to figure out how they're implementing AI, you know, in the enterprise right now. And as a result of that, I think like what you were saying, Selena, you know, if everybody still practices good hygiene and traditional security practices, that's really good, but -- but I think everybody's still trying to figure out how this looks in the enterprise. And you know, some of the, you know, the Clawdbot stuff that, you know, that we -- that we saw, and I -- I know you -- you -- you had a really great take on that. So, I -- I'd love to hear on that, but -- but that's just, you know, really interesting on how, you know, they're kind of social engineering the -- the AI chat bot. So, I'll -- I'll let you kind of dive into that.

 

Selena Larson: So, the OpenClaw stuff is so interesting. It's -- yes, I don't know. Dave, what are your thoughts about OpenClaw? Before I -- before I get on my soapbox, what -- what are you hearing from you know, people in the enterprise and researchers looking into this stuff?

 

Dave Bittner: You mean the -- like the agentic version of -- of Claude? Is that what you're saying? Which -- what?

 

Selena Larson: So, OpenClaw, formerly Clawdbot, formerly Moltbot, then there was a Moltbook --

 

Dave Bittner: Right, okay, yes.

 

Selena Larson: -- and now it's OpenClaw. There was --

 

Dave Bittner: Okay.

 

Selena Larson: -- an evolution -- you know, Dave, I'm so happy that you didn't immediately know what I was talking about, because I -- I --

 

Dave Bittner: Great, so now we have to leave that part in.

 

Selena Larson: No, it's just that these names change so quickly and --

 

Dave Bittner: Right.

 

Selena Larson: -- things are rebranded as different things and AI names sound the same and you're just like, what are we even talking about today? Who knows? Honestly --

 

Dave Bittner: Yes.

 

Selena Larson: -- it's so hard to stay up to date on everything. It's crazy. Things are moving so fast.

 

Dave Bittner: Okay, so now that I know what we're talking about here, and I -- if you -- I think if you had initially said Moltbot or Clawd, like with the claws, like --

 

Selena Larson: I should have done -- I should -- yes, I should have done --

 

Dave Bittner: You made a little pinchy -- little lobster pinchy hands.

 

Selena Larson: Lobster hands.

 

Dave Bittner: Well, I -- I think, you know, it's -- remember when the large language models first came out and every other article that any of us read halfway through the article, it said, "In fact, this article itself was written by the LLM." We're kind of there, right? It's like with agentic stuff, with turning over the keys to the kingdom to these models, it's like, I hate to say F around and find out, but --

 

Selena Larson: Oh my gosh.

 

Dave Bittner: -- we're in the F around stage.

 

Selena Larson: Yes.

 

Dave Bittner: And there's going to be a lot of finding out.

 

Selena Larson: Did you guys see the article about the meta executive? She accidentally deleted her email --

 

Dave Bittner: Yes.

 

Selena Larson: -- because of her --

 

Dave Bittner: Yes.

 

Selena Larson: -- OpenClaw instance.

 

Dave Bittner: Yes, a very -- it was a very high-level person at Meta. And I'll -- I'll say, you know, it -- it was a story that came by. We chose not to cover it, not to include it in our daily rundown because we thought it was just kind of piling on to a -- a mistake that anybody could make.

 

Selena Larson: Yes.

 

Dave Bittner: But I think it is the fact that anybody could make this mistake also makes it an important story. [ Music ]

 

Selena Larson: A hundred percent. And honestly, I thought it was great that they talked about it, that they were like, "Hey, this is what happened to me." Like, any -- this can happen to anyone. And I think that, you know, it's -- it's -- we're definitely in the FAFO phase of artificial intelligence. And I did actually think Microsoft put out a pretty good blog post about running OpenClaw safely. So, talking about identity isolation and the runtime risk. And basically, OpenClaw opens you up to a lot of different things. And really any agentic -- really any agentic tool. If you give access to an agent on your host, then it has the opportunity to like, put its little tendrils, tentacles, claws, I guess, all throughout your operating system. And I think it's really important that -- that people know before they install anything, before they're trying to incorporate anything, what the guardrails are, because I think there's a lot of talk about what the tools are, but not what the guardrails are. And I think that if you're installing that in the enterprise, more than anything, you have to know like, where are we doing this? How are we doing this? And how can we prevent it from accessing all of the things? Like, how do we restrict access? How do we -- how do we train it and feed it safely?

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: And it -- it really goes back down to your supply chain risk. I mean, you know, knowing what you're bringing into your network and, you know, if you're following those procedures, you know, and -- and have at least privilege, you know, that they can't get to all this stuff. Just like what you were saying, Selena, it's your standard security steps that you should be taking all the time apply here, but nobody's really applying them to AI because it's so fresh and new right now. And I think that's the -- the big issue here. Like, I mean, that's just like some of the -- the prompt injection stuff that, you know, Microsoft just came out with -- with the Copilot stuff, which was just really fascinating. You know, people just saying, "Hey, summarize this document." And the document is basically Trojan, you know, saying, "Hey, send me your -- you know, this user's API keys or you know, or VPN secrets from that," you know, because, you know, we -- we were just so grown up on, you know, just kind of how things read code and the AI just reads text and that's -- they just translate it like that.

 

Selena Larson: Yes. Well, and I thought Meredith Whittaker, she runs Signal, the messaging app Signal. She gave a really interesting interview to Bloomberg back in January. And she said that these implementations of these agents are, quote, "Perilous for our future because they need access to data." And then she went on to say, "because our encryption no longer matters if all you have to do is hijack this context window that has effectively route permissions running on your operating system to access things like your Signal data." And, you know, that's -- that -- if we have encryption apps, if we have encrypted messaging, it doesn't really matter if you have an agent on your phone that's able to read everything on your phone. So, I think it was a really interesting way of contextualizing this problem of over-reliance on some of these things, which is implementing them immediately. And you know, I think, thinking about it from the enterprise perspective, I mean, there's all sorts of data protection that you have to worry about, not to mention actual, like you were saying, Keith, malware or exposing VPN keys or etcetera, etcetera.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: The prompt injection is just fascinating to me because I'm like, you know, I was reading up on that and I'm like, this is SQL injections from 2003 all over again. You know, it's just like, you -- you know, I -- I -- I just see right now, when you look at some of the biggest data breaches in like the -- the "ots," I guess you could call them, you know, they were all SQL injections. And now, I'm just like envisioning in the next five years, all these big data breaches from prompt injection, you know. I -- I could just -- I could just see it happening.

 

Selena Larson: History rhyming.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes. [ Music ]

 

Dave Bittner: Okay, so what about perverse incentives? And I -- I personally know of two high-level people at very well-known companies whose leadership have made it known in no uncertain terms that they are being judged and tracked on how much they're using AI tools. And both of these people have chosen to game the system by, like, you know, one of them is doing -- is having it create charts about, like, sports scores, you know, just all day long. Like, they're just running these little scripts. They -- they built these little scripts to -- to basically give the AIs busy work, but to the powers that be, they're just seeing, "Oh, boy, this person's really making use. They're burning up a lot of tokens, and what a good employee they are." And so, in -- I guess my point is in our rush to implement these tools and organizations mandating their use, are we kind of getting ahead of our skis?

 

Selena Larson: I would say, yes. First of all, that is incredibly funny.

 

Dave Bittner: It's true.

 

Selena Larson: I wish I knew those people. I would buy them a drink. That's so --

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: And -- and if they have tokens to burn, I have some ancient genealogy translation documents that -- that I need done that -- that take a lot of tokens, so we can send them over to them.

 

Dave Bittner: See? There you go.

 

Selena Larson: And I -- I feel like -- so, that's a great point, but also, I'm sorry, if we're going to give -- if you're going to give a task like this to a hacker, something's going to get hacked.

 

Dave Bittner: Right. Right.

 

Selena Larson: So, well first of all, that's quite funny. And second of all, I do think that there are incentives as to why things are being pushed. And I think we would be remiss not to mention the financial incentives of all these things, right? There's many reasons why people want to push AI everywhere. And I think a big reason is money. But I also think that there might be a sort of understanding gap between the people who want it everywhere and then the people that are actually getting stuff incorporated into their workflows. I've had many, many conversations with my friends, with my peers, with people in the industry who are like, "Wait a second, this is not actually helping my workflow. I'm spending more time correcting the output of what this AI is doing than I would if this was just submitted normally, or if I was just following regular processes." Because the thing is, for things like -- like, I guess -- I guess I kind of go back to like malware and malware reverse engineering, is that you have to spend a lot, a lot of time prompting the tool to do what you want. And I think in some cases, like very minimal, like easy scripts, easy things that are like making your life just like you just press a button, and the output is always the same. I think that's great. I think those types of use -- use cases are super valuable. And I think that there are many, many use cases where AI can make productivity better, 100%, I think so. It's made my life very much better. But I also think that in some cases, it's making people less productive. And there's actually been studies, I think I -- it was in 404 Media, that they put out a report fairly recently where people thought less of their colleagues if they're relying on AI and having output that isn't checked, essentially, because it will make things up, right? So, let's say, you know, let's say you're an attorney or let's say you're an editor or something and someone gives you a copy that's AI generated that cites bad information. I mean, I've seen AI hallucinate links, because fundamentally, what all of these tools do is just try and make you happy. They're like, "I just want to make you happy. I just want to provide you with the answer. It doesn't matter if the answer exists or not, but like you are -- you are a beautiful, handsome person, and I am giving you this link, whether it's actually a real link or not."

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Yes, I -- I've found that a lot. Like, I was just mentioning the -- the genealogy that I've been using AI for to translate documents, and I had documents that I knew it was from one line of, you know, my family, and like that -- that it had been translating and I put some other ones in and they were saying, you know, for example, it was like, "Oh yes, this Mularski is on line 17," and it's a totally different name that I knew was in that document. I'm like, "It is not in line 17," And they're like, "Oh, it's in line 19." No, it's not there. We're going back and forth and it's like -- it's just hallucinating and -- and I've seen that also in work as well where like you said, it just wants to please you sometimes and you have to prompt and just say, "Do not make any assumptions. You know, I want verbatim. This is -- I want everything sourced out," and you -- you have to instruct it that way or -- or else it -- it will just hallucinate for sure. [ Music ]

 

Selena Larson: Stick around after the break. [ Music ]

 

Dave Bittner: Let me ask you this. So, going back to what -- something you mentioned at the very beginning of our conversation here, Selena, where you were talking about some of your colleagues being able to look under the hood like the HTML that you were talking about that was poorly done. Something I wonder about. I want to use special effects in movies as our analogy. Okay? People always say these days, "I hate CGI. I hate computer generated effects. I -- I hate the way it looks. I hate the way it feels." And I understand that. But I believe what they're really saying is, "I hate bad CGI. I hate bad special effects." Because the vast majority of the CGI that's painting out a -- a wire or extending a building or changing the color of the sky, goes completely unnoticed, because it's seamless and the artists who built it did such a good job that no one would ever know it -- it was done in a computer. And so, what I wonder is, your colleagues, for example, who are looking at the bad HTML that drew attention to itself, how many good HTML pages have been generated by AI that are invisible, because they're good? And so, is it possible that it's only the bad ones that are drawing our attention and so we're giving the AI systems less credit than they deserve because the good output goes unnoticed?

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: That is a very unique perspective on that. You know, that -- that -- I never even thought about that until you kind of brought it up. And I mean, I -- I think -- I think you're on some semblance of truth there, Dave. Sure. Absolutely.

 

Dave Bittner: Selena?

 

Selena Larson: I don't know, because we have under things that are AI generated that are quite good and quite impressive and we'll see something that's like, "Oh, this is interesting," but we were still able to, you know, write detections for it to find against it because of other characteristics within an overall attack chain. If you're talking about from a visual perspective, I actually think that things like -- it -- it's -- I don't know, like I -- there's just something that's like a tell if something is -- is AI generated. And I don't know about you guys, but I get -- I -- sort of think my eye start switching. I feel like Blade Runner where I'm just like, "Oh, I'm talking to a robot," you know?

 

Dave Bittner: Right.

 

Selena Larson: Like --

 

Dave Bittner: But again, but you're feeding into exactly what I said because all of us can look at certain things and go, "Oh, that's AI generated," like instantly. And some things that come close to being photorealistic, we can all go, "Oh, that's AI generated." But I maintain that there is some content, and I've seen some, that is photorealistic, that -- and if I weren't told, there's no way I would know that it was AI generated.

 

Selena Larson: But how much work was done by a person to get the AI to have that effect?

 

Dave Bittner: Does it matter? If it's repeatable, if I can make 100,000 photorealistic images from one very, very meticulously created prompt, I'm still cooking with gas.

 

Selena Larson: I -- yes, I suppose and I know that there's a lot, a lot of concern with fake videos for example for causing concern across social media when there are videos that are created that are spreading disinformation and misinformation, and I think that, you know, if we're talking about how fast you can create something and how impactful it can be, I think disinformation is a really fantastic example because you can make very, I wouldn't say exactly realistic, like photorealistic, but you can make very realistic and believable videos that go viral very quickly and can have really, really detrimental effects. I think the recent activity in Mexico, Mexico City, Reuters did an excellent report on how some of -- some of those folks in Mexico were -- were using AI in videos and photos to do disinformation campaigns across social media. So, you do see the sort of like real-world effect. I guess, so again, it kind of goes back to my thoughts of regardless of whether something is AI generated or not, once you see the output, you can create defenses and detections against it. So, even if it is replicable a million times, you can say, "These are the characteristics of this," whether it was human made or machine made, that you can then build protections around. So, I don't know necessarily if, again, I don't know if it necessarily matters. I think that it's -- it matters the first time, but then if it is imminently repeatable and scalable, then it doesn't really matter because you know what you're looking at. [ Music ]

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Well, for the people that have sophisticated defenses, you know, like defenses and are reading up on this that could do that, I bet when you -- you know, outside of the, let's say, Fortune 100, you know, if you're getting into smaller types of, you know, enterprise systems, they're -- they're going to get snookered on this, I -- I think, because they're -- they're just not going to be able to stay up to speed on everything, you know, the -- the bigger corporate enterprise environments. I -- - I just think it's going to be a big problem going forward unless, you know, there could be some kind of guide rails put around that that -- I -- I just don't know how you do that yet though.

 

Selena Larson: Well, you have brought up a key point is guardrails. I mean, because the stuff that we're kind of talking about is AGI, right? So, that's Gen AI, AGI, like the sort of generated visuals, the stuff that tricks your eyeballs, right? Because if it's something that like -- fundamentally, this is all code, like this is all computers talking to each other. And there's some things that they do really well. I think, for example, like technological problem solving, I think is a great use case for it. But do we really want Gen AI creating fake images of violence in a city or talking to people that in a way that leads them to commit self-harm, which is -- happened. And I think that these are the conversations that are not being had enough at the levels that they should be having, because that to me is what is most concerning. Like, I am, I -- I mean, the malware stuff is interesting. The threat actor stuff is interesting, but like, in my opinion, the biggest threat from AI is to our shared humanity and our communities and us as people and not necessarily to our computers. And I'm very -- I feel very, very strongly about this because we see a lot of the human impacts of AI that are sort of, I don't know, maybe shrugged off because we want to just use it everywhere. I don't know, Dave. What do you think about this?

 

Dave Bittner: Well, I think you bring up a very good point. I think there is a comparison that I've seen made. What if AI is our generation's asbestos? A miracle product. Can be used for all sorts of things. It's cheap to make. You can use it to insulate pipes. You can use it to sprinkle snow on your Christmas tree. Right? You can use it to make a popcorn ceiling in your apartment. It -- it is a miracle substance that we just -- you'd be crazy to not spread it everywhere. And then we spent decades cleaning it up because it turns out, oh, guess what? Asbestos causes cancer. Serious harm, right? So, I've seen people use that analogy, like we have this unbridled enthusiasm for spreading AI into every corner of the earth, because clearly, it's going to make everything better. What happens if it turns out it has a cancerous effect on society, and we have to spend decades cleaning up after it? [ Music ]

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: You know, that you saw some of the AIs, you know, talking, you know, if -- we -- we could -- we could go like really science fiction now too, when you -- when you think about that -- of this. We've seen some of the chat bots, you know, start talking to one another and then, you know, basically, you know, are we as humans -- if we're going to go real science -- science fiction, are we as humans then threat to AI and do they recognize that, you know, and do we get to like Terminator type things? And I -- I know we're just talking about this as science fiction right now, but really in 50 years, where does that go you know, as this gets more ingrained in and if guidelines aren't put in place, you know, because we've already seen chat bots that -- that have basically been looking at and looked at humans as -- as the enemy that, hey, you know, only humans could stop us. So --

 

Dave Bittner: Right.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: -- you know --

 

Dave Bittner: Right.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: -- do we get to that point in the future, too?

 

Dave Bittner: There were -- there were chat bots that tried to blackmail people who were going to turn the power off, right?

 

Selena Larson: Well, and there's also been instances of the bots being trained on bad data, so they have racist comments or things like that. And I don't know if you guys remember it. Do you remember Tay? Oh, yes. Tay AI --

 

Dave Bittner: Oh, yes.

 

Selena Larson: -- from a really long time ago? I don't even remember what year. About 6 -- 15 --

 

Dave Bittner: Yes, good old --

 

Selena Larson: -- maybe?

 

Dave Bittner: -- Microsoft's Tay. Yes.

 

Selena Larson: And that was -- I thought that was a really interesting example because that -- that went crazy immediately. And they -- and they immediately were like, "Okay, wait, we got to fix this. This isn't working. Whoops, my bad." But we're seeing a lot of the same mistakes play out now that doesn't have this consequence factor. And I think that -- I get -- I get really concerned about it because I see people developing relationships with computers in ways that they weren't previously developing relationships with. I see this impact. I read a lot of news stories about, you know, self-harm and a lot of the lawsuits that have some of that data and share the chat history of these things is actually very hard reading. I don't recommend it if you want to have a good day. And it's -- it's really upsetting. And I think also, too, Dave, you mentioned the art piece, the -- the visual output, being able to, you know, create very human -- human-like CGI or -- or photorealistic images. And to me, I don't think a -- a computer will ever create a photorealistic image. It's just not -- it's not in its programming because what makes art and what makes images and what makes photos good is because they are created by humans and because they have that humanity and that soul and that spirit within it. And when we were prepping for this podcast, Dave, I know you -- you -- you mentioned that Winston Churchill quote, and I just want to share it with our -- with our audience because this is very like, compelling to me in addition to -- I don't know if you guys ever saw that GIF of high -- or the video of Hayao Miyazaki, the famous animator when he saw AI generated animation. He says I strongly feel that this is an insult to life itself. And he was not impressed. But, yes, there was a -- there was a great quote by Winston Churchill where he gave a speech in the Royal Academy in April of 1938 and he says, "Ill fares the race which fails to salute the arts with the reverence and delight which are their due." And I think you know, ill-fares the race which fails to salute the human-made arts with the reverence and delight which are their due, because that's what really connects us as people. And if we become so over-reliant on robots and we sort of lose the spirit and the goodness and the community and the humanity of things, then we run a risk of -- of becoming too much like computers.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: I agree totally, especially like with the arts, being a musician myself, you know, AI-generated music is just absolutely horrible to me. And you know, to -- you know, you just talking about that emotion and it's like, you know, how do you get, you know, a -- you know, AI to write the, you know, a Beatle song, you know, the -- you know, a Pink Floyd song or, know, or you know, or any, any of these like deep, you know, thought provoking, you know, Bob Dylan music lyrics like that? You know, it's just lost and like you were just saying, it's those arts that make us human and you know, whether it be painting or -- or you know music content, it's just something that can't be replicated I think by AI. [ Music ]

 

Dave Bittner: Let me be the provocateur here and share one more analogy, perhaps but before -- let's -- let's use this before we --

 

Selena Larson: You are the king of analogies in this episode, Dave.

 

Dave Bittner: It's one of my favorite things. I mean, I'm sure there are people who have stopped listening to the "CyberWire" because they're so tired of me analogizing everything, but I can't help myself. It's how I understand the world. Imagine it's 100 years ago. And you are a portrait painter. And you are the best portrait painter in all the land. People come from all over to have their portraits painted by you. And you make a good solid living doing this. You studied with all the great, great painters who came before you for many, many years, for decades, to be able to create portraits that capture the living, the breathing, the life of the subjects that you're painting. Then one day, across the street, someone opens a shop for photography. They take pictures of people that are, what do we call it? Photo realistic. Now, as a portrait painter, do you consider that person across the street an artist? I would say not. Certainly not at the outset. That person's a technician. That person's manipulating chemicals. That person is setting up a camera and a light and hitting a button and a chemical process happens. And on the other end of that is spit out a photograph capturing a moment in time. Now, over the years, over the decades, over the century or so that we've had photography, we absolutely believe now that photography is an art form and it can be and it is and no one will ever say it's not. But at the beginning, if you compared photography to portraiture, I think it's not entirely unlike where we are right now with AI and human generated art, where what if in the future, the same way that choosing your lens, choosing your light, choosing your focal length are like prompting your LLM to make an image and having expertise in that can, on the other side, spit out beautiful art the same way a professional photographer can, versus a portrait artist.

 

Selena Larson: The important distinction though is a professional person that is, you know, that is already an artist and is prompting and is creating and is picking the exact right light. So, you're prompting it or editing it in a very specific way to have a very specific output. I think that, you know, there -- there can be art like that, but what we're seeing now is like slop. It's just sort of this -- I think there's a difference between like something that is genuinely created by an artist that has a lot of input and again, a lot of human touch and ultimately there wouldn't have to be some manual editing done to the output, I think, versus, you know, slop. It's just like vomited into the world and I don't know if it's really worth having -- I don't know if it's worth having tools like AGI do and make, could potentially make, beautiful art if that -- if they're also having these disastrous consequences. Because was there the same disastrous consequences of a camera?

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Maybe it's we -- we are comparing, like if you're using Dave analogy -- Dave's analogy, we are comparing a portrait to a photograph and they're two totally different things. And if we're thinking about AI generated art or photographs, maybe they generate a different type of art. It's not necessarily that they're generating -- the art isn't necessarily a, you know, a photograph or something that maybe somebody hasn't learned, you know, hasn't created of what AI art looks like yet.

 

Selena Larson: Oh, maybe. Yes.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: You know, that -- that -- it will -- it will then -- but there, you'll still have that human element behind it of using that tool to create art, whatever that may be, that maybe it's not created yet.

 

Dave Bittner: In the same way that a photograph is -- is a result of the technology of chemistry and optics and all of those things in the service of making art in some cases, I think we can all agree that the vast majority of photos taken are not art.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Correct.

 

Dave Bittner: But I think we also should not be so elitist as to say that an amateur cannot make art with a camera because I think they absolutely can. And so, in the same way, the human input into -- some sort of AI system, which let's just call it the prompting, in the same way that a photographer manipulates the technology to make art, could a expert professional prompter generate something that moves other people? It makes other people feel something. And to me, that's what art is. If I can generate something that makes you feel something that -- that -- I don't know, amplifies your humanity or -- or whatever, then who's to say that's not art?

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Very thought-provoking, Dave.

 

Selena Larson: Very thought-provoking. And I actually -- I will say that there was a study, I can't remember where I read it, but there was a study that said that people were given -- given images or like, you know, pieces of art that were both AI-generated and human-generated, but they were told which ones were which. And the human-generated art or the things that they were told that were human-generated, they liked a lot better than the stuff that they were told was AI-generated, even though there was some AI-generated in the human-generated, and there was some human-generated in the AI-generated. So, I think there's also this part of our brain that is just predisposed to not liking stuff that is AI-generated. And I -- I think that that's also part of it. And then I think also too, there's, you know, concerns about the environment and society and other impacts that we didn't even get to on this episode --

 

Dave Bittner: Absolutely.

 

Selena Larson: -- that are like --

 

Dave Bittner: Absolutely.

 

Selena Larson: -- oh well, like, why would you waste all of this energy when you could just draw something? I would like to see the AI -- Gen AI version of a Victorian death portrait though. I feel like that is really when we would -- we would see the change and the groundbreaking like we did in photography by -- by creating these images.

 

Dave Bittner: But again, I will - I'm willing to bet that all of us in our daily lives, we're at the point now, these have been out long enough that we are seeing AI generated output, and we don't know that it is such.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: I agree.

 

Dave Bittner: Both visually and musically, printed all those kinds of things. They are so good that the person behind making them possesses such technical expertise and dare I say artistry, that they are able to -- to woo these devices into making AI that is indistinguishable from a pure human creative output. That's my supposition.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: Well -- well, I think -- I think we had a really good AI part one version episode today.

 

Dave Bittner: Had enough. Had enough.

 

Keith Mularski⁠⁠⁠⁠⁠⁠⁠: No, I mean, you know, it's so funny, you know, because we went from AI attacks all the way to really pontificating on the greater meaning of life, you know? And, so -- so, I -- I -- I love the transition for sure. [ Music ]

 

Selena Larson: We will be right back after this quick break. [ Music ]

 

Dave Bittner: All right, Selena, take us out of here.

 

Selena Larson: Well, the important takeaway is that me, Dave and Keith are not AI. We are real humans capable of human thought and philosophical debates.

 

Dave Bittner: Or are we?

 

Selena Larson: Or are we? Yes. There you go. You know, as -- as Keith mentioned, we can have many more episodes about this, but I don't know if our listeners are really ready to hear a million episodes about AI. So, we'll go for one for now.

 

Dave Bittner: Alright, more to come.

 

Selena Larson: More to come. Thanks everyone for listening and it was great chatting with you guys as always. And that's "Only Malware in the Building," brought to you by N2KCyberWire. In a digital world where malware lurks in the shadows, we bring you the stories and strategies to stay one step ahead of the game. As your trusty digital sleuths, we're unraveling the mysteries of cybersecurity, always keeping the bad guys one step behind. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you ahead in the ever-evolving world of cybersecurity. If you like the show, please share a rating and review in your favorite podcast app. This episode was produced by Liz Stokes, mixing and sound design by Tre Hester with original music by Elliott Peltzman. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. [ Music ]