AI Found 20 Zero-Days. Smart Contracts Are Next

Transcript

I think the timeline has been going a little bit crazy for all of the mythos stuff. Um the Anthropic has basically said this model is too dangerous to release. So, we have released it to you. Um and uh I I guess we should probably go through a few of the things that this model has been doing, right? Um it has uh figured out like 20 zero-day vulnerabilities in like decades-old software. Um which feels a little bit like what crypto has been kind of going through for the last like whatever, uh

you know, 6 months where um all these old things keep getting hacked and we're like, "This thing's been on the chain for 4 years. How is it possible that uh you know, we we're in this position where um you know, Balancer V2 gets hacked, right?" And then Mythos is like, "Well, I have hacked OpenBSD." And you're like, "Excuse me?" Like So, so it's just it's kind of petrifying. Um so, yeah, I mean, uh Austin, what's what's your take on on Mythos based on on what you've seen so far? Um just generally and then I guess in relation to all of the like crypto agent stuff you've been doing.

Yeah, I think I mean, the crypto agent stuff I've been doing is very insecure. So, that'll be the first thing to [laughter] break. But I think that like uh like I said, I think it's like we got to rip the band-aid off. Like it's going to happen. We got to do it, you know, smart, but I think that we're we're going to see this. We're going to see uh AI get so good that a bunch of hacks are going to happen and then not so many hacks are going to happen happen anymore. And I think the Balancer one is the one that really sticks out of my mind. Like code that was around for 5 years all of a sudden gets popped for, you know, hundreds of millions of dollars or a hundred million dollars or whatever it was. Like that's that's scary and crazy.

And I think we're going to see that for a little bit and then not so much anymore. But yeah, I'm I'm ready to to to rip the band-aid off. Let's do it in a bear market. >> [laughter] >> Uh um and so so I think in crypto we have a slightly different problem and and Tay, maybe maybe you can address this, right? Um it is certainly awkward if you have a hundred thousand Linux servers and like, you know, load balancers are running BSD and it's like, uh we don't want to take this thing down because if we take it, you know, it's not easy to replace this architecture, right? But it's just software. You can

in theory patch it, upgrade it and like do a hot swap or something like that, right? Like these are systems that are not necessarily designed to like be immutable. Um what happens if Mythos is like, "Oh, you need V2? I've cracked it." Yes. That's going to be a problem. A massive problem. And I mean, I think this industry has realized this over time that immutability is like freaking amazing in so many ways, but also quite impractical um and and creates risk.

And I think this was actually a a big conversation during the Drift hack. Right. >> aftermath because all the Ethereum people were like, "Just don't have keys. Don't have upgradeable contracts." I get it, but at the same time, like I'm not convinced that we are I'm if I'm going to if you're if you're launching something today, I'm not going to bet that it's perfectly secure forever. I'm sorry. Like I can't say that.

>> is Uniswap is uh the counterexample to this that has given people more hope than probably should would be my like hot take on this, right? Like Uni-Uniswap is amazing software, but like it's like one function. Like it literally like it just rebalances a thing, right? Like it it, you know, it is not a super complicated multi-contract smart contract suite. Like, you know, it it's like for what it is.

And yet like my confidence to its unhackability has gone down significantly over the last like 48 hours, right? Like if if, you know, people like these are thing these are these are pieces of software that are securing like billion-dollar systems with people getting paid tens of millions of dollars a year to secure them and of course Uniswap has had this giant bug bounty. If you can hack it, then, you know, like so So, it's not like we haven't had you know, security pressure in in the ecosystem.

Um but it's a different level. Like a different level, different scale to what some of these systems have had and yet there's like zero-days in them. So um I we talked about this we talked about this like maybe a month ago, Tay, right? Where I was like, "How confident are we that someone doesn't have a really smart like fine-tuned model that they've been working with that's like systematically going through and like breaking these smart contracts?" Like given what they've said about Mythos, does that change your perspective on the last like

couple of months of hacks or you think it's still just a coincidence and it's going to get much worse? No, I don't Well, I I do think it's going to get worse for sure. I think we're in trouble. Like um but I think I still think okay, Mythos is like it's a level up. Um and I think that they have it seems like they've specifically been thinking about security and been like like the people that really know this stuff have been zoomed in on on the security elements, right? The exploit elements, the safety elements that come with the security elements.

Um it it wouldn't I mean, obviously there are going to be people who are like just random people that are doing the same things. Um how far they've gotten and how like what's the most productive use of those things? I feel like I feel like it's not uh I don't think we're at the point where they've like honed it in so completely that they can just like let let it loose, right? Let their little hacker quad loose on whatever.

Um but I do think that we've seen like AI-assisted, right? Where the AI is identifying things or speeding up those feedback loops, right? Cuz when you're fighting these exploits, you have to like uh there's like so many different sort of stages of finding an exploit. You have to like hold all this data or you before you had to like hold all this data in your head and like understand it and then even once you figured out like this is a weakness, you then had to execute it, right? You had to actually put together the series of stuff that would do it without fail.

I definitely think that we've seen AI like rapidly like assist with with some of those stages. I think Mythos is scary cuz it sounds like they're like, "This is like I'll just go hack you." >> You don't even need It's not assisting you anymore. It's doing the thing, right? Yeah, exactly. And that's what scares me, especially because Uniswap is also unique in the sense where they do have as a protocol, it's low-level, right? They do have a huge bug bounty on it. Most of like the core software that runs this world is not built by by people with million-dollar bug bounties, right? It's like

>> Yeah, fair. That's why I think this is going to be worse for Web2 than it is for Web3. I think that like even though we have like money right behind, you know, one line of code, someone joked that like the weth contract got hacked, right? Like when when there is just like a smart contract that has a deposit and a withdrawal function, it's basically like you're you're talking about like hacking a protocol at this point if if there's something that goes wrong there. Are we not But sorry, Austin, like are we not worried about that >> [laughter] >> as well? Like, you know, we like validators like I mean, This is the more complicated piece, right?

>> Yeah, like validators are and like that would be I don't even know. Like or even just say, "Hey, Mythos buddy, I've got some interesting news for you. There's this thing called MEV and if you can like just listen to this stream of transactions and just tweak it a little bit, we can make a lot of money." And Mythos is like, "Yeah, I love I love breaking things. Let's go." >> [clears throat] >> I do think yeah, so we're talking about breaking things and making a lot of money and then MEV is just like being smart about ordering transactions and just like playing the game of of like the mempool. I think there's a ton

of money to be made by just like running these awesome frontier models. I I I don't know what we'll see. I think it's going to be really interesting. I think So, I I love Uniswap. I think Uniswap is beautiful and it's like really isolated versions, and it's not upgradeable. Like the way that Uniswap V2 functions is like this beautiful hyper structure. And if V3 gets popped, like V2 probably won't. And if V2 gets popped, V3 probably won't. Like there's not a lot of like cascading things that can happen from from system to system. So, I I don't know. I think it's going to be worse for Web2 than it is for Web3. And I think that in Web3, there are people who have deployed their systems and done

tons of bug bounties and tons of audits. And I think that's going to be good for them. But of course, like we saw the Balancer thing. And the Balancer thing really changed my mind. That was when I was like, "Oh gosh, like that's shit." >> [laughter] >> This thing, yeah, this is dangerous. And And you know, that was very unlikely to be Mythos. Realistically, right? Like that was very unlikely to be Mythos. >> That was probably a dude with Opus. Yeah. No. That's true. So, I think the other thing that's interesting about Mythos, like, you know, just zooming out above the like security risks and all of that stuff that that we see. Um this is the first time that we've seen, at least to

my knowledge, right? Like we've seen like, you know, early previews, but like most of the time they just let the thing out in the wild. They're not that scared of it that they're like, uh we'll like give it to people, you know, and like if you read they they released the the age of card, right? It's like this like 200-page document that says all the things they did and like basically ass covering. So, when like burns the world down, they can be like, "No, no, no, we tried to like stop it from doing this." Um so, so they they um you know, for previous models, they give it to researchers, they give it to a bunch of people, they do a whole bunch of things before this thing gets out in the wild, they do internal testing, etc.

This is the first time, at least to my knowledge, that I've seen a model that's so smart that they're so scared of it that they're like, "We need to give this to a small group of like 12 partners, so, you know, AWS, Apple, um Nvidia, the Linux Foundation, etc. Um and say, "You're allowed to use this kind of for security purposes for the next however long." I I I don't know if I saw how long um uh So, who finds all the bugs?

But they're like they gave [laughter] Also, you know, how expensive is this thing going to be as well? Because they gave them 100 million dollars worth of usage credits. Now, I'm an inference enjoyer myself, but that's a lot of that like it would take a lot to burn through 100 million dollars in credits. So, un- like I think they're just imagining these guys are going to run automated loops. So, you know, one one thing that's kind of begs the question of is like um uh Boris Journey um had a really good podcast uh a couple weeks ago where he was like, "You should be building for the model like we internally, we built for the model 6 months from now, right?

Not for the model today." So, it's 6 months from now, and the model is Mythos, right? Um which could be anytime in the next few weeks. Um and all of the things that we've been building around like harnesses and loops and things, it all of that stuff could just fall away if this Mythos is smart enough that it's like, "No, no, it's but like you don't need to put me in a weird like looping thing, bro. I can just like, you know, do this uh for 2 months straight or something, right? You know, because one of the one of the things is like this long-running activity, you know, uh kind of frontier as well, right? Like that as the models get smarter, they can do things autonomously for longer without losing their minds and and you stay on task or whatever. If you enjoyed

this segment, make sure you tune in at 4:00 p.m. Eastern every Wednesday, where we have much more content like this. >> [music] >> Multicoin Advisors is an emerging technology growth firm that has helped create over 50 billion dollars in enterprise value for more than 80 clients, like Piff, MoonPay Commerce, and Wormhole. They've worked with some of the largest and most impactful companies in the space. They're the partner you want when you're navigating markets and trying to break out from the noise. They help navigate TGEs, go-to-market BD and partnerships, capital markets advisory, PR, media placements, key opinion leader activations, and more. Driving execution from launch to scale. Their results are

measurable. To learn more and start building real traction today, visit multicoinadv.com. Multicoin Advisors is an emerging technology growth firm that has helped create over 50 billion dollars in enterprise value for more than 80 clients, like Piff, MoonPay Commerce, and Wormhole. They've worked with some of the largest and most impactful companies in the space. They're the partner you want when you're navigating markets and trying to break out from the noise. They help navigate TGEs, go-to-market BD and partnerships, capital markets advisory, PR, media placements, key opinion leader activations, and more. Driving execution from launch to scale. Their results are

measurable. To learn more and start building real traction today, visit multicoinadv.com.