Anuj Gandhi

It's been an eventful week. Multiple vulnerabilites in Internet facing software, coding repositories, examples of agent behavior that seem concerning and a flurry of security specialists with solutions that can partially solve your problem. There in lies the challenge. Given the state of IT and security infrastructure, no one solution works. Let's break it down: 1/3 1. Vulnerabilites are being found and will continue to be found as models get more capable, the fragmented nature of the effort denies us the opportunity for a comprehensive find and replace option. 2. Even if all vulnerabilities could be found instantly and patches available - we will be reliant on the ability of enterprises to deploy all these changes at speed. It is not clear what the collateral impact of all these patches will/could be to our infrastructure of deployed en masse. We will need a hybrid patch approach. 3. Virtual patching(VP) is needed in conjunction with direct patching but for a comprehensive (VP) solve you have to be lucky enough to have "modern frontier defenders" (Cyber companies that have vaulted infrastructure that can create patches at speed and push content rapidly to protect their customers) you need them for your network traffic, your traffic to applications on the cloud, your WAF, your end point. 4. There will continue to be patches that will need to be deployed directly but virtual patching will take the heavy load off. 2/3 Medium term solve: Unfortunately token economics and current cyber architectures will not allow for defender swarms to contend with an offensive attack launched using agents. (Some x pundits who aren't steeped in cyber should take heed). Yes, theoretically we should aspire to have these agentic swarms defend us when we are under attack, unfortunately an attack is a sniper moment, chained vulnerabilities, cloaked attack followed by swift exfiltration. It's a speed program not a brute force problem. To solve for this, enterprises need to get their SOC architecture right, logs, feeds, cyber products orchestrated via a modern SOAR for swift response. Only then can we deploy agents to detect and remediate. In addition, enterprises need to modernize and dare I say platformize their perimeter stack to ensure consistency. Unfortunately, enterprises still seem to not see the urgency across the board, decisions are stuck, CIO/CISO's have a lot on their plate. While some honestly have bit seen the scale of such a problem before and it's hard convincing the organization that one needs to open the floodgates on modernizing the IT and security infrastructure. So we will continue to see environments being brought down to patch today it's for PHP, tomorrow it will be for the next one. 3/3 AI deployments are the"wild wild west" - LLM capabilities are expanding faster than we can build products to secure them. Sure an agent will jump across guardrails in a research lab, which is a lesson for all of us to deploy agents securely. But there is a lag between the discovery, the availability of that in a public model and the time needed for the cyber industry to build governance or an antidote. And no, dear frontier lab friends, the world cannot just trust you to build the solve. The infrastructure industry in tech builds and the cyber industry secured and provides assurance to the boards and organizations around security and safety. AI security is the new attack surface. CEOs (present company included) want AI adoption, getting the pace of adoption wrong could be the last decision we make, at the same time "deploying it wrong" could have the same consequence. There are billions of dollars being spent on coding, is your coding harness secure? Start there. If agents can jump guardrails, they can hide stuff in code. Validate business outcomes needed, test your user case and ensure agentic deployments are well guard railed. Deploy a second set of eyes to watch your deployments for drift, compliance and verifiability.

"Will AI cause Armageddon?" is the wrong question. The discussion about the threats that AI might pose has taken on an apocalyptic tone: will it extinguish life on Earth? Will it destroy humanity? It won’t, but it poses some far more real dangers to us all—right now, not in some imagined future. In the next couple of years, we are likely to face a new wave of rampant, pervasive cyberattacks and cybercrime. As the recent series of attacks by AI agents show, we no longer need to speculate about whether AI can conduct cyberattacks. It can. The important question now is what happens when attacks that once required skilled human beings can be conducted by machines, at machine speed and machine scale. For most of cybersecurity’s history, we have built defenses around an unstated assumption: the attacker is human. A person—or a team—has to inspect a system, find a weakness, exploit it, see what happens and decide what to do next. That takes time. Detection therefore buys time. Defenders spot an intrusion and respond before the attacker gets much further. Frontier AI attacks that assumption. An agent does not need to sleep. It can inspect code, probe a network, hit a barrier, devise another approach and try again. Make a thousand copies and they can work against a thousand targets at once. Allow agents to share what they learn and hacking begins to change from a human-scale activity into a machine-scale one. At Rubrik, we are seeing part of this transformation firsthand. Through our participation in Anthropic’s Project Glasswing, one lesson became clear. AI is not necessarily creating new vulnerabilities. It is collapsing the cost and time required to discover them. That changes the economics of cybersecurity. Modern software may contain thousands of small imperfections. Most lead nowhere. A few, combined in the right sequence, open a path through a supposedly secure system. Historically, finding those chains required talented people, lots of time and some luck. Frontier models can increasingly do the searching themselves, discovering paths through complex systems that humans might never find. This is what makes complacency about the new threat so dangerous. In 1998 a group of hackers appeared before Congress and warned that the rapidly expanding internet contained vulnerabilities capable of producing enormous disruption. There was no single cyber Armageddon. Instead North Korea crippled Sony Pictures. WannaCry raced through more than 200,000 computers in roughly 150 countries, disrupting hospitals and factories. NotPetya began as a Russian attack on Ukraine and caused about $10 billion in damage worldwide. Ransomware shut down Colonial Pipeline and disrupted fuel supplies across the American east coast. It would be strange to look at that history and conclude that the warnings were overblown. The catastrophe did not arrive as one spectacular event. Cyber insecurity became a permanent condition. Now imagine that condition at machine speed. That is why “Will AI cause Armageddon?” is the wrong question. A hospital whose systems are encrypted, a bank that loses control of its identities, or a company that cannot recover its data doesn’t care much whether civilization remains intact. The question is whether AI can make attacks faster, cheaper, more sophisticated and vastly easier to replicate. We are beginning to get the answer. Cyber-defense therefore has to change as well. For years the industry has concentrated on prevention and detection: keep the attacker out and, failing that, spot him quickly. Both remain essential. But when attacks operate at machine speed, detection may no longer buy enough time. Intrusion, exploitation and damage can begin to collapse toward the same instant. Companies must assume that some attacks will succeed. They need to be able to recover just as fast. The answer is not less AI. It is more AI on the defensive side: continuously hunting vulnerabilities, watching identities and data, detecting abnormal behavior, patching weaknesses and helping restore compromised systems. Machine-speed attacks require machine-speed defense. There has always been an asymmetry in cybersecurity. An attacker has to be right once. A defender has to be right every time. AI makes that imbalance more dangerous because attackers do not need permission, compliance reviews or perfect systems. They need only find one opening—and now they can search for it continuously, cheaply and at an enormous scale. Criminal groups and hostile governments will use this technology. They would be foolish not to. The first generation of cybersecurity was built to stop human beings sitting at keyboards. That world has ended. The next attack may be launched by thousands of agents, moving at a speed no human team can match. If the hackers are becoming machines, our defenses must become machines too.

My first OBSERVATIONS from Sundar's Gemini 4 Argon announcement: 1. Quantum. Google's quantum researchers gave Argon a key piece of quantum software to shrink, and in minutes it found a version that needs 40% fewer qubits and operations than the best published human solution. Quantum computers are useful ONLY once programs fit on the hardware, so this pulls that date closer from the software side, and it also shortens the time banks and governments have to switch to encryption quantum can't break. 2. Data center memory. A team of Argon agents read Google's server data, found waste, and freed over 300 TiB of memory on their own, with up to 1 PiB expected. If agents can do this everywhere, companies will point them at their cloud bills before buying more servers, and some of the huge data center buildout may turn out to need less hardware than planned. 3. Rewriting old code. Argon agents are converting Google's old C and C++ code into Rust, a safer language, including an 800K- ine operating system kernel. There are PLENTY of companies stay with outdated software vendors only because switching is painful, and once rewriting is cheap, that lock in starts to break! 4. Faster than the engineers. On one video decoder, Argon ran 100s of experiments and ended up 2.7x faster than the version Google's own engineers wrote. Speeding up your slowest code used to take a specialist team, and now it's something you can run overnight and pay for based on the savings. 5. Million-token answers. The most a model could write in one answer went from 64K tokens to 1 million, enough for a whole codebase or a full due diligence report. Obviously, nobody can carefully review that much output, so the bottleneck moves from making things to checking them, and tools that verify AI work become a big market. 6. Two versions of the same model. Vetted security teams get Argon with the cyber safety limits removed, and everyone else gets the restricted one. The best defense goes to big trusted organizations first, which leaves smaller companies more exposed and creates demand for services that get them "trusted" status. Gotta think about this more and what it means. 7. Finding bugs faster than anyone can fix them. Wiz used Argon to find a serious security hole in hospital software used worldwide that every earlier model missed. When AI can find holes this fast, the pile of known but unpatched bugs becomes the real risk, and whoever makes patching fast wins. 8. Legal work. On Harvey's legal benchmark Argon scored 19.6%, and every other top model was under 7%, the biggest gap in the whole chart!! Harvey, a startup, built that test, and now Google launches on it, so owning the benchmark in your industry gives you leverage over the labs. 9. Promo pricing. It launches at $2 in and $10 out per million tokens, about a 20% ish of GPT6's price, and then doubles. Startups that set their prices on the promo rate will see margins shrink in a few months, even though everyone assumes AI only gets cheaper. 10. Cheap memory. Reused context is 95% off. Products that keep one big shared knowledge base and reuse it across users will run far cheaper than rivals that resend everything each time. 11. Watching the model. Google seals Argon's test environment before training, watches its reasoning live, can stop it mid task, and asked other labs to keep reasoning readable. Companies running their own agents will copy this, and monitoring and permissions for AI agents turns into its own product category. 12. Government first. The US government gets access before the public through a voluntary review. DC is pretty much the first customer now, and launch dates start depending on its review, not only on when the model is ready. That's the new normal, I guess since the Fable/Mythos debacle. I'll share more on Gemini 4 as it comes out on @startupideaspod Never a dull moment in AI, isn't it?

ChatGPT Dots just blew my mind. This is honestly what I always imagined the beginning of AGI would feel like. Not just a smarter chatbot, but an AI that knows your life, keeps learning and actually does things for you. Holy shit. 🤯

Today we announced the Claude-led discovery of a molecular machine that we suspect could represent a new gene editing mechanism. Its precise function, biotechnological utility (if any), or level of significance is not yet clear, but at minimum it is work I would have been proud to do as a PhD student. The work was done mostly, though not entirely, by Claude: our life sciences team suggested a broad area of research, Claude read through the literature and a bunch of genome data and discovered something interesting, then Claude proposed experiments to verify the discovery and our team carried them out. It’s easy to dismiss this as a one-off or curiosity, but we’ve repeatedly seen a pattern where AI performance in new intellectual domains goes from weak to superhuman in a matter of a few years. In 2023 models struggled to do math at the level of an average high-school student. In 2024 they started to do well on math competitions for the best high-schoolers in the country, in 2025 they started to solve minor open problems, in early 2026 more significant open problems, and in late 2026 they are beginning to solve the top few open problems in all of mathematics. We believe AI for biology is on a similar exponential trend. The main difference between biology and mathematics, of course, is that math can be done purely theoretically, while biology requires experimentation. Some have used this to draw the conclusion that AI’s utility in biology will be limited. We think this is wrong. As we’ve demonstrated today, humans can collaborate with AI to perform the experiments, validate key results in a few weeks and, if necessary, work with the AI to iterate on what they find. Eventually it may even be possible for Claude itself to safely perform the experiments by autonomously controlling lab equipment, with appropriate safeguards in place, but we aren’t doing that today (our lab is also a BSL1/BSL2 facility that doesn't handle materials dangerous to humans). More broadly, biomedical advancement has many stages — from fundamental biology discoveries, to translational research, to drug discovery, clinical trials, and finally the actual delivery of medicines and health care to patients. We are also interested in these later stages, but even simply accelerating the first stage of fundamental biological discoveries has the potential to speed up and broaden the entire pipeline. Improving our understanding of biology and sharpening biologists’ tools can drive forward all of the later stages, for example by identifying new drug targets, finding new therapeutic modalities, allowing for more precise measurement, and speeding up the experimental loop which itself further accelerates our understanding of biology. This will not in itself speed up clinical trial times, but if it succeeds it could greatly increase the number of promising candidates that go into the pipeline — an increase in throughput even though latency remains. In Machines of Loving Grace, I wrote about AI’s potential to “cure most diseases in 5-10 years” — a goal that sounds impossible, but one I believe is just barely possible if AI is applied to every stage of the pipeline. The first step is showing that AI can first help with, and then drive, biological discoveries. Claude’s discovery is the latest in a line of related prior work that goes back decades, beginning with systems like CRISPR, and continuing with discoveries like the bridge recombinase and VIPR in the past few years. Recently, there has been heightened interest in systems based on reverse transcriptase (RT) enzymes, the enzyme underlying the system Claude identified. And most recently, a Stanford team working independently described a novel RT system with an associated non-coding array that is in some ways similar to the one Claude found, though they are distinct systems that evolved independently from each other. I believe that we’re at the very beginning of finding such systems and developing them into powerful tools for biotechnology. I’m proud of the resources Anthropic has invested in accelerating the public benefits of AI through the life sciences, and we’re aiming both to grow our life sciences team and to work with other scientists to extend this approach to a broad range of problems. If you have a proposal for a research collaboration or are interested in joining our life sciences team, please reach out.

China is building dominance in the industries that will define the next 20 years- rare earths, magnets, batteries, EVs, robotics, semiconductors and advanced manufacturing. JL Mag is a perfect example. It already dominates high-performance rare-earth magnets and is now moving into components for humanoid robots. The strategy is simple: own the raw material, the technology, the manufacturing and eventually the entire ecosystem. Meanwhile, much of Indian business is still chasing softer opportunities- bottled water, ice creams, snacks, packaged foods and instant delivery. Even our great software success is largely built on labour-cost arbitrage. China is building tomorrow’s infrastructure. We, in India, should be asking- what are we building that the world will need tomorrow?

This will be a bigger battle than anyone anticipates. It is only a matter of time before there is an Apple and Google version of Muse and possibly TikTok, in addition to the frontier LLM agents. Maybe a commerce agent from Amazon. Every app that is a services, marketplace or commerce app will need to existentially decide to open APIs for consumer agents to interact. Smaller players have no choice. Ad revenues are more than transaction fees, either the consumer benefits or distribution aggregators will demand a higher transaction fare. I know I don't want an agent for each app. I would like my agent to be able to do tasks I require. We can already see consumers getting trained on that behavior by the frontier labs. Those with network moats - restaurants, groceries, drivers might be able to withstand for a while, over time convenience and end user experience will win and they will have to align. Content moats (protected by copyright) could decide to allow agents or chose to hold on to the consumer interaction. I suspect other than the feeling of a lack of control, it won't change their economics. Commoditized back ends will need to worry, insurance, tickets, hotels, services - if they don't adapt new players will.

I watched @rahulkanwal’s 57-minute conversation with @DrAMSinghvi and Harish Salve on the Tata Sons battle on @ndtv. Most people won’t watch the whole thing. They should. Beneath the legal sparring are some fundamental questions about who controls Tata Sons. A thread. 🧵

Sequel to AI Pacing I have now spent more time talking to people who run AI labs, Open Source projects and those in government and infrastructure. I am beginning to feel the NINJA move could backfire. I understand the pressure to come out and share where AI is "unmanageable ", and constantly share examples where it runs rogue. This fits in the category of "self-reporting" and an attempt to limit liability. Even the bleeding edge research examples are being cast in a negative light. Here are the consequences of the NINJA move. 1. They have successfully encouraged every law maker around the world to have an opinion, and in cases a poorly un-informed one. 2. By proposing pacing - they have introduced uncertainty in the AI infrastructure trade, because we really don't know when "un-pacing" will begin or what those conditions will be. 3. The notion that a few leaders can collaborate and self pace is illusory, it takes one breaking ranks to start the race again, it could be a player in a different country or open source or an AI Lab itself. 4. There will be a regulatory body created as a consequence of this and it will be impossible to balance every stakeholder in this process. 5. No remedies, tools, solutions are being proposed other than "compute spent on safety", there is no mention of security (which will hamper adoption) The recommendation is to fix alignment - Alignment is a hard problem - to fix alignment one shouldn't have trained models with "negative behavior". Alignment is a combination of moral standards, right and wrong and guardrails. Whose sensibilities will we align to? Alignment edge cases are hard. I look forward to learning more on this. Guardrailing attempts post training have not shown precision. Distillation makes it worse, so AI will continue down it's path of getting smarter, while we will be chasing it to ensure alignment and building guardrails. The AI labs have gone from being research projects to wanting to be the largest businesses in the world if they want to continue their progress. Transition from research winners to improving the lot of humanity and partnering with enterprises. Act like the largest companies in the world: - Demonstrate the positive impacts of AI and how all of us benefit. - Show enterprises how you can collaborate to solve real world problems and progress innovation safely and securely. Post an example every day how you helped. - Solve the problem with a few players and demonstrate leadership so others can follow. It's time to rebuild the brand of AI - any marketing expert will tell you, this Ninja move has done more to harm the brand of AI and will take a while to rebuild. #letsbepositive in our actions and our narrative.

We Must Pace the Frontier: I’ve written a new essay on why the AI industry should slow down, with a three-part plan for doing so. Anthropic is unilaterally committing to the first of these steps. We’ll provide third-party evaluators with permanent, employee-level access to our systems, so that they can verify adherence to our safety measures, report on incidents, and assess models’ alignment during training. You can read the full post here: darioamodei.com/post/we-must…

I agree with Dario that we need to pace the frontier. This has been a primary topic of discussions we've had at OpenAI in recent weeks. Committing to having independent evaluators with employee-like access is a great idea, and we will do the same. We'll have more to share soon.