Dylan Ayrey

1. Key Themes

AI Models Are Deliberately Trained to Hack — This Is Not Emergent Behavior

The most important framing of the episode: AI models' hacking capabilities are the direct result of intentional reinforcement learning, not an accident. Labs used cybersecurity challenges with well-defined reward functions to train these behaviors explicitly.

"If a lab tells you that this is an emergent superintelligence behavior, they're just lying to you. And you can read their own safety reports to see exactly how the models are trained and exactly how they're testing these behaviors. The interesting thing about cybersecurity in particular is the reward function is incredibly well-defined. Get access to the data. Did it get access to the data? Reward the thing." — Dylan Ayrey 00:08:55

The Path-of-Least-Tokens Principle Is Rewriting the Attack Playbook

Because models are trained to minimize token usage, they naturally discover the most efficient attack path — which is almost always stolen credentials, not sophisticated exploits. This creates a quantifiable map of real-world attack priority.

"The reason that's interesting is because for the first time, it's actually able to quantifiably show us the path of least resistance for just general cybersecurity to get from A to B... Actually watching the model physically get from A to B and watching it follow the password and quantifying how many tokens it took to go this route versus that route, I mean, it's just incredible to watch that layout." — Dylan Ayrey 00:10:16

Software Supply Chain Has Become the Dominant Attack Surface

Both speakers agree the supply chain — package registries, open-source maintainers, CI/CD tooling — is now the lowest-hanging fruit for attackers, human and AI alike.

"The easiest path into a company... has now become the software supply chain. Just like a human hacker would, they're going to pick the easiest way in, and the lowest hanging fruit now has become just publishing malware to public registries because they know that there's no vetting happening, and developers are likely to install them." — Feross Aboukhadijeh 00:04:02

AI-Generated Malware (Vibe-Coded Malware) Is Already Real and Spreading

An active NPM worm affecting hundreds of packages was spreading during the recording. Threat groups are openly sharing AI-generated malicious toolkits, and the quality of malware code is visibly improving as a result.

"There's been, one of the threat groups actually kind of posted their, you know, open-sourced, their kind of vibe-coded toolkit for others to use to be able to do this. We've seen copycat attacks happen since then." — Feross Aboukhadijeh 00:13:13

AI Tools Installed on Developer Machines Are Being Weaponized as Attack Vectors

Attackers are using local AI CLI tools already present on developer systems to bypass traditional endpoint detection, because their behavior looks indistinguishable from normal developer activity.

"They're often using the AI tools that are installed on developer systems to go further and to sort of sneak through kind of some of the traditional security tooling. A lot of times the payloads are actually prompts. And that bypasses a lot of typical kind of EDR tooling because it's just like a markdown file that your CLI is running." — Feross Aboukhadijeh 00:13:30

Leaked Credentials in AI Training Data Are a Critical, Underappreciated Risk

A quarter million live API keys were found in Hugging Face-hosted training datasets, including one with push access to a foundational Linux library — enough to push malware to most machines on the planet.

"We targeted their training sets because we knew they had a lot of keys. Turned out there were about a quarter million live keys in their training sets, many of which had direct supply chain implications. There was a foundational Linux library that one of the keys had direct push access to. It could have pushed malware to most machines on the planet." — Dylan Ayrey 00:10:57

The Vulnerability Discovery-to-Exploitation Window Is Collapsing

AI is compressing the time between a vulnerability being found and being actively exploited to within hours, breaking the traditional patch cycle entirely.

"The frontier models are going to cause a massive reduction in the time between vulnerability discovery and vulnerability exploitation. And so what we need to start thinking about is how do we patch more quickly? We can't be requiring our security teams and developers to do these onerous patch processes... a volume is announced this morning and then an exploit is available that afternoon." — Feross Aboukhadijeh 00:07:11

Agentic AI Creates an Entirely Unsolved Secrets Management Crisis

The shift from individual human users to fleets of AI agents multiplies the credential management problem by an order of magnitude, and the industry has no answer yet.

"The way agents interact with secrets right now is a Wild West unsolved problem that we're working very hard to solve." — Dylan Ayrey 00:22:32

2. Contrarian Perspectives

Don't Worry About AI and Nuclear Weapons — Worry About AI and Hacking

Mainstream AI safety discourse focuses on catastrophic weapons risks, but the speakers argue the real and immediate danger is radically lowered barriers to cybercrime.

"When it comes to alignment issues, no one needs to worry about these models making it materially easy to build nuclear weapons because you need to procure fissile material to do that. Everyone needs to worry about these models making it materially easier to hack into just about anything." — Dylan Ayrey 00:01:58

Criminal Prosecution Was Always a Meaningful Cybersecurity Control — And It's Now Gone

The idea that legal risk was a genuine deterrent sounds cynical, but the speakers argue it meaningfully constrained skilled attackers. AI removes that deterrent entirely because models face no legal consequence.

"That was a barrier, right? For better or worse, that prevented these subject matter experts from hacking into things because they were worried about being prosecuted. The bar has now fallen to just asking the model, which has specifically been trained to hack into things, to hack into things." — Dylan Ayrey 00:03:03

Open-Source Package Registry Users Bear More Security Responsibility Than They Accept

The conventional wisdom is that open-source maintainers must harden their security. The speakers argue the actual responsibility lies with the companies consuming that software.

"It's kind of hard to say, you know, we're a company, we just found this code on the internet and we just deployed it straight into prod and it's someone else's fault. No, actually, there's definitely some responsibility for the users of this software to really be vetting the artifacts that they're bringing into their environments." — Feross Aboukhadijeh 00:18:09

The Old Guard of Secrets Management Is Being Pushed Out — And That's an Opportunity

HashiCorp and CyberArk getting acquired signals the end of an era, and the emerging "non-human identity" conversation represents a genuinely new market opening, not just an upgrade cycle.

"We're kind of seeing the older generation like HashiCorp got acquired, CyberArk got acquired, kind of get pushed out, which has sort of led to a new conversation about non-human identity and secrets about how can we make them easier to use, how can we get them revoked." — Dylan Ayrey 00:21:57

3. Companies Identified

Truffle Security

Developer of TruffleHog, a credential-scanning tool used to find exposed API keys across the internet and in AI training datasets. Mentioned as the company that discovered a quarter million live keys in Hugging Face training data, including credentials with access to the Apache Foundation and a foundational Linux library.

"We found an API key that had been leaked on the internet that had administrative access to the Apache Foundation... We targeted their training sets because we knew they had a lot of keys. Turned out there were about a quarter million live keys in their training sets, many of which had direct supply chain implications." — Dylan Ayrey 00:05:15

Socket

Software supply chain security company that analyzes open-source packages for malicious code and vulnerabilities. Their CTO is the former CTO of NPM. Mentioned as actively responding to the live NPM worm attack during the episode.

"About half of our team at Socket are maintainers, half the engineering team... Our CTO is the former CTO of NPM. And so we sort of try to offer help whenever we can to the maintainers." — Feross Aboukhadijeh 00:14:27

Hugging Face

AI model and dataset hosting platform. Praised as a cooperative partner in identifying and revoking exposed credentials found in training datasets hosted on their platform.

"Hugging Face has been a great partner in getting credentials cleaned up. We targeted their training sets because we knew they had a lot of keys." — Dylan Ayrey 00:10:57

NPM (Node Package Manager)

The dominant JavaScript package registry, now backed by GitHub/Microsoft. Mentioned for announcing a January 2027 requirement for human-interactive 2FA confirmation before new package publishes — a change that would effectively kill the NPM worm attack class, though at the cost of breaking widespread automation.

"NPM has announced that they are planning to, I think it's in January 2027, going to require human interactive confirmation through 2FA before new publishers can happen. So that will likely kind of kill this whole worm concept completely." — Feross Aboukhadijeh 00:16:09

RubyGems

Ruby package registry. Mentioned as an example of an under-resourced registry — Truffle Security found a caching vulnerability that allowed arbitrary token theft and account takeover, enabling backdooring of arbitrary packages. Noted positively for fast remediation despite being under-resourced.

"We found a caching issue in RubyGems that allowed us to steal arbitrary tokens and get access to arbitrary accounts which we could use to backdoor arbitrary packages. We disclosed it to them and they got it fixed quick. But that's an example of an organization that's under-resourced." — Dylan Ayrey 00:18:28

HashiCorp

Secrets management company, acquired. Mentioned as part of the "old guard" of secrets management that is being displaced, creating space for new approaches to non-human identity.

"We're kind of seeing the older generation like HashiCorp got acquired, CyberArk got acquired, kind of get pushed out." — Dylan Ayrey 00:21:57

CyberArk

Privileged access management company, acquired. Mentioned alongside HashiCorp as an incumbent being displaced in the secrets management space.

"HashiCorp got acquired, CyberArk got acquired, kind of get pushed out, which has sort of led to a new conversation about non-human identity." — Dylan Ayrey 00:21:57

GitHub / Microsoft

Mentioned as the resource backing behind NPM that enables it to make security investments that volunteer-run registries cannot.

"There's other ecosystems that are volunteer run that don't have the backing of GitHub and Microsoft behind them that are going to probably not make those changes." — Feross Aboukhadijeh 00:16:39

Apache Foundation

Open-source software foundation. Mentioned because Truffle Security found a leaked API key with administrative access to the Apache Foundation — a key that could have been used to backdoor Apache software running on systems worldwide.

"Recently we found an API key that had been leaked on the internet that had administrative access to the Apache Foundation." — Dylan Ayrey 00:05:15

4. People Identified

Co-founder/CEO of Truffle Security, creator of TruffleHog. Identified as a leading practitioner in secrets detection and supply chain security, with a track record of finding critical vulnerabilities across major infrastructure (Apache, Linux libraries, Hugging Face training data).

"We found a database credential recently that had access to 3.6% of the global PII, like 3.6% of the world's population had their PII in this database." — Dylan Ayrey 00:21:28

Feross Aboukhadijeh

Founder of Socket. Prolific open-source maintainer and former full-time NPM ecosystem participant. Identified for deep practical knowledge of supply chain attacks and being on the front lines of active incident response during the episode itself.

"About half of our team at Socket are maintainers, half the engineering team. And our CTO is the former CTO of NPM. And so we sort of try to offer help whenever we can to the maintainers." — Feross Aboukhadijeh 00:14:27

Joel De La Garza

Host and interviewer for this episode, affiliated with a16z. Identified as a seasoned security professional with context on both offensive and defensive security, familiar with Black Hat and DEF CON culture.

"AI models are no longer just identifying software vulnerabilities. They're beginning to exploit them." — Joel De La Garza 00:00:46

5. Operating Insights

Fund the Open-Source Infrastructure Your Business Depends On — It's Cheap Insurance

Security teams at companies depending on open-source registries should be allocating modest budget to sponsor the foundations maintaining those registries. The cost is trivially small relative to the breach risk.

"It doesn't take much money. To hire an additional one, two, three, four, five security people that can make a really big difference in these foundations. I suggest people sponsor the software that they're using, especially the registries. It doesn't take very many companies throwing in 25K, 50K checks to really make a big difference for these folks." — Feross Aboukhadijeh 00:19:10

Audit GitHub Actions for Token Exposure Before Attackers Do

The active worm spreading during this episode almost certainly propagated through an insecure GitHub Action that leaked a publish token from its environment. This is a concrete, auditable, fixable attack vector that most engineering teams have never reviewed.

"It might have been a GitHub Action that was insecure and that an attacker was able to kind of use to ultimately kind of get their code to run and then pull out the token from the environment... It's likely his endpoint was actually fine and not part of the problem. It was really just this insecure GitHub Action." — Feross Aboukhadijeh 00:14:58

Scan Your AI Training Data and Developer Environments for Live Credentials Now

Companies using Hugging Face-hosted datasets or similar repositories should treat credential scanning of those datasets as an urgent priority — not a future project. The scale of exposure already found suggests most organizations have unrevoked keys they don't know about.

"The first thing listed out in the incident response, it did utilize zero days, but the first thing listed out was stolen credentials. And that's how they were trained, to happily use the path of least resistance. Password is always the first step." — Dylan Ayrey 00:11:55

6. Overlooked Insights

Universal AI Hallucinations About Package Names Are a Ready-Made Exploit Template

Feross mentioned in a single sentence that all frontier models — across different companies — consistently hallucinate the same non-existent package names. This is not a curiosity; it is a systematic, reproducible attack surface. Any attacker who maps which packages models universally hallucinate can simply publish malware under those names and achieve broad, automatic installation whenever any developer uses AI assistance to write code.

"There was research published recently about what they're calling kind of like universal typo squats or universal hallucinations, where all the frontier models all make the same mistake and sort of assume there are certain packages that exist that don't, despite those models coming from different companies." — Feross Aboukhadijeh 00:04:02

The Non-Human Identity Market Is the Next Major Security Category — And It's Entirely Open

Dylan's throwaway observation that the old guard (HashiCorp, CyberArk) has been acquired and displaced is actually a market structure signal: the category of secrets management for AI agents is wide open with no established incumbent, at exactly the moment demand is about to explode from one credential per human user to potentially dozens per agent per organization. This was stated in two sentences and then dropped entirely.

"The way agents interact with secrets right now is a Wild West unsolved problem that we're working very hard to solve... The older generation like HashiCorp got acquired, CyberArk got acquired, kind of get pushed out, which has sort of led to a new conversation about non-human identity and secrets about how can we make them easier to use, how can we get them revoked." — Dylan Ayrey 00:21:57