Alex Stamos, Cognition’s chief information security officer, told Semafor’s Reed Albergotti on Future Proof that cybersecurity is, in his view, entering a “dark age.” He expects AI to increase attackers’ capabilities, but argues that defenders can work to shorten the period of heightened risk he foresees. He suggested they should try to make a hypothetical 10-year dark age last five years or three.
Stamos said there are “real risks from AI”, but criticized what he called an “almost religious framework” that leads some people to interpret each development through beliefs they already hold. He does not believe AI systems are conscious. In cybersecurity, he argued, the greater risk is “bad guys using AI to increase their capabilities”. His prescription was to explain how a danger could arise in specific steps, then work to prevent those steps: “What you should not do is just quit your job and freak everybody out.”
In a separate Big Technology interview published Oct. 23, Stamos discussed a PHP vulnerability as a more immediate problem. He described it as “pre-authentication remote code execution”, meaning, in his account, an attacker could target a website without logging in. He said the patch he described was released for the latest PHP family, leaving some sites on older versions facing code changes to upgrade; he also mentioned unofficial backports. Stamos described extensive automated exploitation and predicted later breaches and fraud, but said he lacked good statistics on how often AI was being used in those attacks. That interview illustrates his approach to a current threat, not independent confirmation of his broader forecast.
Separately, @joshua_saxe argued that calling “php2shell” the worst day in cybersecurity requires an explanation of the technical risk and attackers’ motivations. He also warned of a looming AI security crisis. @ZackKorman called AI cybersecurity discussion “utterly incoherent” and urged people to improve their security. For individuals concerned about account exposure, Stamos recommended using a different password on every website and suggested a password manager.
Comments