Patrick Austin hosts Nick Bradley, Don Cowan and Jim Guinn on IBM Technology’s 20-minute Security Intelligence panel, covering AI-assisted security research and external model evaluation.
Discovery moves faster than deployment
- The panel describes PHP2Shell, two old PHP vulnerabilities reportedly found with AI assistance, with exploit information leaking before patches were available.
- Finding every affected installation matters because PHP can be buried inside applications and legacy systems.
- Unsupported versions and compatibility constraints can turn an urgent patch into an upgrade and regression-testing project.
- Guinn argues for using similar research tools throughout development, alongside outside reviewers who challenge familiar assumptions.
Access and independence are separate questions
- The host describes six METR researchers receiving employee-like access at Anthropic, within a tiered external-evaluation program.
- The panel asks what publication rights, disclosure restrictions and actual findings make that access meaningful.
- Guinn proposes model developers reviewing one another’s work, borrowing an analogy from financial-audit peer review.
- Cowan wants concrete vulnerabilities and useful results from the program; the panel’s skepticism remains its opinion.
Keep the conclusions bounded
- This is commentary on reported incidents and evaluation arrangements, with no original exploit test or model audit shown.
- The panel’s PHP prevalence estimate cannot tell a reader whether a particular server is exposed; check affected versions and configurations against an advisory.
- Proposed competitor review is a suggested governance model, separate from the arrangement the host reports.
- A final Tor-relay story returns to reused passwords and operational hygiene; anonymized routing still requires end-to-end transport protection.
“You got to know where it’s at before you can fix it.” — Nick Bradley, 4:04