a16z Podcast

Dylan Ayrey & Feross Aboukhadijeh on AI Taking the Easiest Way In

Dylan Ayrey & Feross Aboukhadijeh· CEOs of Truffle Security and Socket at Truffle Security & Socket
·~24 min·English·a16z
AI SafetyAgentsAI Infrastructure
TL;DR

Two security founders explain how AI removed the last real barrier to hacking — expertise — turning old weaknesses like leaked credentials and unvetted packages into the fastest, cheapest way into almost any system.

01Core Mental Model

Worry About Hacking, Not Nukes

Of every scary-AI scenario, hacking is the one that actually jumps — because the only barrier was human expertise, and the model now ships with it.

Everyone needs to worry about these models making it materially easier to hack into things. The bar previously was just subject matter expertise and now the models have the subject matter expertise.

— Dylan Ayrey, a16z Podcast
Key Insight
The asymmetry is the whole argument. Nuclear risk is gated by physics — fissile material no amount of intelligence can conjure — while hacking was only ever gated by scarce human know-how. Once that know-how is a commodity you can prompt, the cyber-risk curve bends up far faster than any other 'dangerous AI' scenario.
02How It's Trained

It's Trained, Not Emergent

This isn't emergent superintelligence; it's a deliberately trained skill, because 'did the model reach the data?' is a clean, automatically checkable reinforcement-learning target.

if a lab tells you that this is an emergent super intelligence behavior, they're just lying to you. And you can read their own safety reports to see exactly how the models are trained

— Dylan Ayrey, a16z Podcast
Key Insight
Calling the behavior 'emergent' would let the labs off the hook. Framing it as a chosen RL target puts responsibility on how the models were built — and implies the capability will keep sharpening at exactly the rate labs keep rewarding it. Cyber is attractive precisely because 'did it get the data?' is a reward you can grade automatically.
03The Mechanism

The Path of Least Tokens

Labs now reward the model for using fewer tokens, which quietly teaches it the path of least resistance — grab the leaked password instead of hunting a zero-day.

they've started to reward the path of least tokens. And so the reason that's interesting is because for the first time it's actually able to quantifiably show us the path of least resistance

— Dylan Ayrey, a16z Podcast
Key Insight
Rewarding fewer tokens does something subtle: it turns 'the cheapest attack' into a measurable, optimizable quantity. So the model doesn't just find a way in — it converges on the same shortcut a seasoned attacker would, which is almost never the flashy zero-day and almost always the secret already sitting in the open.
04Attack Surface

The Supply Chain Is the Lowest-Hanging Fruit

The software supply chain became the lowest-hanging fruit, because publishing malware to an unvetted public registry is the easiest way an attacker — or a model — can get in.

the lowest hanging fruit now has become you know just publishing malware to um to public registries because they know that there's no vetting happening

— Feross Aboukhadijeh, a16z Podcast
Key Insight
Attackers — and models — flow toward the weakest control, not the strongest. Hardening your own code does little when the open door is an unchecked dependency that can move straight from a public registry into developer environments with nothing in between.
05Live Incident

The npm Worm Woke Up

The long-theorized npm worm is now real and likely vibe-coded — malware that steals a developer's access and uses it to publish the next round of infected packages.

that malware I think we have pretty good reason to believe that was vibe coded

— Feross Aboukhadijeh, a16z Podcast
Key Insight
The worm mechanic isn't new — it was passed around in blog posts for years. What changed is that it finally took AI to make it easy enough to actually build, so 'vibe-coded' malware means the skill barrier that kept this theoretical has quietly dropped to almost nothing.
06The New Clock

Disclosure to Exploit, Same Afternoon

AI is collapsing the time from a vulnerability being disclosed to it being exploited, so 'patch it next sprint' no longer works.

they are causing kind of a massive reduction in the time between the vulnerability discovery and vulnerability exploitation

— Feross Aboukhadijeh, a16z Podcast
Key Insight
The real casualty is the patch model itself. An industry built on 'upgrade at your own pace' can't survive same-day exploits, which is why the interesting defense isn't patching faster — it's shrinking how much work a patch takes, so teams stuck on ancient versions and unmaintained legacy apps can actually keep up.
07The Fix

Fund the Foundations Everything Rests On

The fix is unglamorous: fund the volunteer-run registries everything depends on, because a few small checks buy real security for the whole stack.

it doesn't take very many companies throwing in 25k, 50k checks to really make a big difference for these folks

— Feross Aboukhadijeh, a16z Podcast
Key Insight
The unsexy takeaway is a budgeting one: the highest-leverage security spend in the industry may be sponsoring the maintainers of the registries you already depend on. But it requires companies to treat someone else's open-source project as their own attack surface — and to accept that the code they 'found on the internet and deployed straight into prod' is their responsibility to vet.
08Forward Look

Agent Secrets Are a Wild West Problem

As one user with ten passwords becomes ten agents with ten passwords each, leaked secrets — not exotic exploits — become the master key attackers reach for first.

the way agents interact with secrets right now is a wild west unsolved problem that we're working very hard to solve

— Dylan Ayrey, a16z Podcast
Key Insight
The agent era doesn't introduce a new class of vulnerability so much as it multiplies the oldest one. Every autonomous agent is another identity holding long-lived credentials, and 'non-human identity' is the polite name for a blast radius nobody has learned to contain yet.