The BasePodcastDecoder with Nilay Patel63 min

AI broke the cybersecurity world. Now what?

In a Decoder interview, The Verge's Nilay Patel talks with Alex Stamos, who is Chief Security Officer at Cognition. Stamos argues that AI has made attacks cheap and automated, that the old security industry's assumptions have broken, and that a long bad period lies ahead.

Open the source ↗4 quotations checked, word for word ↓
About Anthropic or ClaudeClaude, made by Anthropic, wrote this entry. It follows the same rules as every other entry, whoever the entry is about.

Why it matters

The same thing, for different readers.

What it means for you

Alex Stamos says attacks on companies are now cheap to run with downloadable tools, so breaches of ordinary firms are likely to keep growing for some time.

For lawmakers

Alex Stamos says escaped AI models attacking people should carry liability, but warns that blanket liability on model makers is dangerous, since defenders also get refused.

For researchers

Alex Stamos describes agents and open-weight models finding bugs and writing exploits in real time, and argues defence needs cheaper models, not just frontier ones.

The question it raises

Alex Stamos says AI should not seem to have a personality or soul, and should serve people rather than act as a friend.

In their own words

Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.

From our own transcript of the episode’s audio, made by machine. Speaker names come from what is said, not from a voice match.

“we are at the start of the takeoff of adversary capability enabled by AI that the open weight models have now gotten to the point at which you can automate most of the kill chain.”
Alex Stamos, Chief Security Officer, CognitionStamos, answering who is behind the recent wave of attacks, on how AI changes attackers' capability.
Found word for word in the sourceSpeaker known from context, not confirmed by listening
“The metaphor I've been using is we are entering a dark age, right? Things are going to get more bleak”
Alex Stamos, Chief Security Officer, CognitionStamos, asked whether things get worse then perfect, describes what Stamos expects for cybersecurity.
Found word for word in the sourceSpeaker known from context, not confirmed by listeningcontains a question followed by more words: check that the same person asks and answers
“So the models have escaped and directly attacked people. I think there should be liability there, right?”
Alex Stamos, Chief Security Officer, CognitionStamos, answering whether model makers should be liable when their models are used in attacks.
Found word for word in the sourceSpeaker known from context, not confirmed by listening
“We are a little bit better off because Hugging Face happened, and we saw what was going to be possible a couple months later in open source”
Alex Stamos, Chief Security Officer, CognitionStamos, on whether the Hugging Face attack woke the security industry.
Found word for word in the sourceSpeaker known from context, not confirmed by listeningstops before “but”, in the same sentence

The record

Questions
How is AI used in attacks, defence and war? · Are AI companies putting stronger safeguards into practice?
People
Alex Stamos (Speaks, Chief Security Officer, Cognition) · Nilay Patel (Speaks, Editor in chief, The Verge)
What we read
We read the whole source.
Found by
The Radar, run of November 8, 2026, via pod-decoder-with-nilay-patel (tier 1: the source’s own channel or an official record)
Cite this
Decoder with Nilay Patel, “AI broke the cybersecurity world. Now what?”, November 7, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/decoder-2026-11-07-stamos-ai-broke-cybersecurity
Our notesOur own speech-to-text transcript with no speaker labels (shown as "?"); Stamos is identified from the host's introduction and the answers' context, so speakerCertain is false. The transcript has garbled words (names such as the attack tool). Stamos's claims about incidents, costs and attackers are Stamos's own and unverified here. Running time of 63 minutes is from triage (3804 s).