Erik Edin

some quick thoughts on frontier labs and cybersecurity 1) two critical vulnerabilities were discovered in php that allow for remote code execution; the first was reported on august 11 2) it seems now humans just weren’t devoting so many resources to finding vulnerabilities, and perhaps weren’t that good at it in the grand scheme of things 3) i think open-source software is going to have to change: maintaining it will increasingly become the responsibility of frontier models and frontier labs 4) no one else will have such advance access to frontier models or be able to spend as much on tokens as the labs themselves 5) so, it makes sense for frontier labs to scan and patch open-source software, especially the code their coding agents use to build software 6) one issue, though, is that open-source projects often have difficult governance structures, so i can imagine a world where frontier labs just fork these projects 7) build and maintain their own versions, making fixes, improving performance, adding features, etc and then train their models to use them by default 8) i can also see a world, very soon, where ~all software at a company has a claude or codex instance running 24/7 that watches over it (like the anthropic superfans) 9) the agent watches an anthropic or openai feed and, when a vulnerability is found, immediately kicks off a full migration to the new version 10) or otherwise refactors the codebase, changes the infrastructure, ports capabilities, etc... to mitigate the vulnerability 11) this will happen automatically, without a human in the loop; engineers will just come in the next morning and see what happened 12) this is part of what it means for coding agents to increasingly own software, and for labs to become responsible for the software supply chain 13) at some level, i think this just becomes the enterprise expectation when they are paying millions for coding agents / the agents are making arch choices 14) it is a very exciting time to be at a frontier lab and think through what this product offering should look like and how it should be sold to enterprise clients