Oct 24, 2026 · 45 min
AI turns cybersecurity into a race defenders may already be losing
Black October! What Is Happening to the Internet? | Hari Mulackal & Odysseas Lamtzidis
As AI lowers the cost of attacking software and exploiting personal data, organizations and individuals face shrinking response times and greater accountability.
- 1AI lets attackers scan and target vastly more systems, making vulnerability discovery increasingly difficult for human defenders to match.
- 2Compromised databases can fuel identity-based extortion, scams, and cascading harm far beyond the original security breach.
- 3Resilience now depends on automated defense, careful custody choices, redundancy, and demanding clear security accountability from service providers.
Don't miss
The guests describe a future in which AI agents use personal information to conduct highly convincing scams at massive scale.
The brief
David Hoffman, Hari Mulackal, and Odysseas Lamtzidis examine why a recent run of incidents feels different: AI is making attacks cheaper, faster, and far more scalable.
The danger extends beyond stolen credentials or funds. Exposed data can enable identity-based extortion, convincing scams, and second- and third-order harms that organizations cannot easily contain.
As vulnerability discovery accelerates, defenders may have less time to patch than attackers need to exploit newly disclosed weaknesses, making automated defense increasingly necessary.
The guests compare crypto’s adversarial security culture with traditional finance, then ask whether AI-driven offense will eventually force software toward greater safety.
Their practical answer is resilience: limit blast radius, use redundancy carefully, scrutinize custodians, and demand visible accountability from companies holding data or assets.
What was said on this episode
30 statements · 11 positive · 18 negative · 1 mixed
“the number of incidents have been going up by a lot”
Listen at 1:17
Security through obscurity is currently breaking down in real time.
“security through obscurity is like breaking down in, you know, real time right now”
Listen at 3:26
AI-enabled cyber operations will become ten times cheaper every six to twelve months.
“this will continue to like get 10x cheaper in every 6 to 12 months”
Listen at 4:42
Hacking can now be conducted at scalable industrial volume.
“Hacking has now become scalable”
Listen at 5:10
The economics of automated hacking is approaching zero cost.
“the economics is falling to zero”
Listen at 5:40
Cheap automated attacks are expanding beyond crypto into the broader web.
“the attention is turning away from, you know, crypto and like just in, you know, broad web too”
Listen at 5:46
Extortion based on breached company data will continue increasing.
“That is going to keep increasing.”
Listen at 8:58
Large-scale data breaches cause genuine economic damage.
“there is true economic damage to these incidents”
Listen at 9:35
AI-generated personalized scams can be scaled to millions of people.
“You can now scale that to millions of people.”
Listen at 12:40
AI-enabled scammers may persuade millions or billions of people at industrial scale.
“they can convince millions of people, billions of people who are not aware of what AI is capable”
Listen at 13:18
Organizations now have less than zero days to remediate some vulnerabilities.
“These days, the zero clock is negative days.”
Listen at 17:05
Companies holding valuable customer data should act immediately on security.
“you need to act today”
Listen at 17:25
Cybersecurity has become primarily an economic problem as attack costs fall.
“security has become an economics problem”
Listen at 19:34
The number of hacks will rise dramatically as hacking costs approach zero.
“number of hacks are going to infinity”
Listen at 19:47
Attackers can immediately exploit vulnerabilities once their existence is disclosed.
“The moment that people are informed that something is possible, they can immediately go after it.”
Listen at 20:21
Cyber offense will largely dominate cyber defense for the next twelve to eighteen months.
“for the next, I would say, 12 to 18 months, it's going to be largely dominated by offense”
Listen at 21:20
Organizations should conduct controlled attacks against their own external surfaces and code.
“the best way to understand what you need to do is to attack yourself”
Listen at 21:26
Security operations will shift toward factory-like continuous automated defense.
“security will also make a similar shift”
Listen at 22:32
Raising attack costs to $10,000 would deter most attackers.
“Make it like $10,000, and most people would not attack you.”
Listen at 23:02
Large organizations will adapt slowly to automated security because bureaucracy is a bottleneck.
“in big organizations where humans and bureaucracy is the bottleneck, it will take a lot of time to adapt to that”
Listen at 23:39
Companies built in adversarial environments have a security advantage.
“there is a better advantage to companies that were built in this”
Listen at 27:25
Coinbase is better prepared to defend against cyber risk than traditional banks.
“Coinbase is better prepared to defend than your bank”
Listen at 28:26
Customer money is currently safer in Coinbase than in Target gift cards.
“your money is safer in Coinbase than target gift cards as of now”
Listen at 29:36
After an initial bloodbath, cyber attackers and defenders will return to roughly equal footing.
“after the bloodbath, it's going to be back to regular, you know, hand-to-hand combat between attackers and defenders on more or less equal grounds”
Listen at 32:59
AI agents conducting cybersecurity will make software safer.
“agents doing cyber will make software better, period”
Listen at 33:18
AI agents will become a persistent class of cyber attackers.
“the next attacker is an agent, and they are not going away”
Listen at 33:33
Consumers should move data and money away from services with inadequate security answers.
“If you don't like the answer, then you should think about moving your data money out of the system.”
Listen at 35:02
Users should assume their services will be exposed and infiltrated.
“assume that the services you're using are exposed and they're going to be infiltrated”
Listen at 36:18
Users should avoid clicking links they consider suspicious.
“maybe don't click on links that you know you feel are a bit sketchy”
Listen at 38:17
Users should probably avoid self-custody for the next twelve months.
“probably not self-custarding for the next 12 months seems a good idea”
Listen at 40:30
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.