Dylan Ayrey
Dylan Ayrey is the co-founder and CEO of Truffle Security and the original author of the open-source tool TruffleHog, which scans code repositories and other platforms for exposed credentials and API keys. He previously served as a senior security partner on the Netflix security team and has spoken at security conferences including Defcon and Black Hat. He is best known for his research on credential exposure, including large-scale scans of AI training data on Hugging Face that identified over 221,000 live credentials across public datasets.
“If a lab tells you that this is an emergent superintelligence behavior, they're just lying to you. And you can read their own safety reports to see exactly how the models are trained and exactly how they're testing these behaviors. The interesting thing about cybersecurity in particular is the reward function is incredibly well defined. Get access to the data. Did it get access to the data? Reward the thing.”
Source→“There were about a quarter million live keys in their training sets, many of which had direct supply chain implications.”
Source→“We were in the middle of partnering with Hugging Face to clean up all of the credentials that had been exposed through all of their training sets... Hugging Face has been a great partner in getting credentials cleaned up.”
Source→“That's an example of an organization that's under-resourced.”
Source→“When it comes to secrets, we're kind of seeing the older generation, like HashiCorp got acquired, CyberArk got acquired, kind of get pushed out, which has sort of led to a new conversation about non-human identity and secrets.”
Source→“If a lab tells you that this is an emergent superintelligence behavior, they're just lying to you. And you can read their own safety reports to see exactly how the models are trained and exactly how they're testing these behaviors. The interesting thing about cybersecurity in particular is the reward function is incredibly well-defined. Get access to the data. Did it get access to the data? Reward the thing.”
Source→“We're kind of seeing the older generation like HashiCorp got acquired, CyberArk got acquired, kind of get pushed out, which has sort of led to a new conversation about non-human identity and secrets about how can we make them easier to use, how can we get them revoked.”
Source→“We're kind of seeing the older generation like HashiCorp got acquired, CyberArk got acquired, kind of get pushed out, which has sort of led to a new conversation about non-human identity and secrets about how can we make them easier to use, how can we get them revoked.”
Source→AI-extracted from podcast / newsletter / paper summaries. May contain errors.