How to be an AI demigod and not get rekt

Transcript

Hello. Oh nice. Perfect. Hey everyone, first and foremost, thank you for coming to all of you. I'm Gory. I'm the CTO at Wonderland and this is Skeletor, co-founder and lead architect at Wonderland. And the thing we want to discuss with you all today is AI and how it affects our processes and how it's been changing how we work for the past year and what do we think will happen next for AI processes, let's put it this way.

This is something we've been Yeah, struggling for the past 12 months or really thinking hard cuz we want to take advantage at the maximum, but at the same time we don't want to up everything we've been building, the quality that we have been shipping, the excellency and everything. So, what [clears throat] if you were given 1,000 interns for free? What if I told you, "Hey, I have these 1,000 friends that just want to do work for you, right? For free and they are eager to just not sleep, drink a ton of Red Bull and just code away."

Would you take them or would you not? And if you do, what will happen to your your organization? How would you coordinate them? How would you spend time to make sure they are doing valuable work? This is a nice meme and I think this will happen more and more and we'll talk about this in the next slides. But one of the main reasons companies will fail and we've seen this with the leak from Tropic uh uh today and a few other things the previous weeks is that AI is very very hard to manage.

So, what's happening right now is that many people are looking at tools and basically going over the next tool and what Cloud Code is releasing, ChatGPT and so on and so forth and you end up spending so much time like actually setting up the tools and changing the tools and looking for what's next and the FOMO that it generates that it generates to me and I suppose to all of you and less time actually shipping what you should be shipping and focusing also like on what you should be focusing. And well, two things here. First, this might even sound funny, right?

Like, "Hey, how can we have burnout if we have all these AI agents doing the work for us? Shouldn't we all be at the beach relaxing and doing nothing?" We find it that is quite the opposite, right? We find that now you have so many pull requests to review, so much documentation, so much things being shipped and also the timelines are getting shorter and shorter and this is natural like to see people burning it out. Like all the context switching that you now have, it's real like and we need to tackle it with the right processes. We cannot just expect everything to go extremely fast and people to adapt because they have not been trained for that, right? This

is not what we have been on boarding people to do. Like the processes also need to change. So, what are you going to maximize? Are you going to maximize amount of line of code of code shipped by day? Are you going to maximize quote unquote what have you done last week? Or are you going to maximize the quality of the things that you do, the quality of the decisions that you take? Are you going to take advantage of all of these agents to do the hard work for you, to go investigate, to go try things out, to follow the process that you set up and maximizing the quality of the things that you do and the decisions that you take as a human?

One thing to add there is that yes, you can go faster, but you can also like be extremely good. One thing we're doing for example is we're putting AI reviewers into every single thing we do and this first makes us makes the quality of what we do way better and then it will make us go faster, which we're already seeing both. The other thing, this phrase is actually quite close to my heart, I'll say, because it's a phrase that one CTO I used to work with 12 years ago told me and it really stuck with me is premature optimization is the root of all evil.

Many engineers do know this phrase. And what it means is basically do not optimize or do not pre-optimize until the problem really becomes a problem, right? But funny enough, this stopped being true. Like with AI, premature optimization actually is a real advantage cuz before setting up all the structures and all the processes, did take a bunch of time. But now the gaps that are being left because you don't don't have that structure are being filled and potentiated by AI, let's put it that way. Like AI agents will go in that gaps and they will maximize the good things and the bad things of your processes.

So having extremely good structures and processes will be so beneficial. So, premature optimization now is quite good. Yeah. So, as Gory was saying, sorry did I cut you off? It's okay. All right, go go. We didn't have much time to prepare this, we were just shipping. So, the thing is as Gory was saying, you first need to uh understand what you're going to do and we'll get to this uh later as well. But the problem now is that for you to have a suboptimal process, it will take much more time to fix that and we can see that easily as devs as just legacy code or things that I don't

know, somebody needs to maintain uh etc. etc. And this literally gets um super clear really really fast. So, you spend way more time trying to fix things later once they break, which they break really really fast, rather than sitting down, maybe go and touch grass, really think about the problem, really think about the setup of the problem and the solution, asking socratically, "Why are you trying to solve this and why is that way the the best way?" And then let AI scale the correct output.

At the wonder, how we approach every single problem since the beginning, since the inception of Wonderland about 5 years ago, was with a very defined structure. We always position ourselves as shipping excellency, right? And maybe many people told us back in the days like, "Bro, why are you like spending so much time like in the idea draft, right? Writing your the scope of what you want to do like in technical documentation, etc." And actually now with AI, this became quite a superpower. Like before it was extremely good, now it's a superpower.

The way at least we do things and we are talking with everyone and recommending them to copy us in this sense is that before even writing a single line of code, we do the technical definition of every single smart contract, off-chain component that we're going to build, how they interact with one another, the invariants, literally everything. Then development becomes quite smooth. And this for AI is gold. Like if you properly define everything and you have architects reviewing this and researchers looking for like things to get inspiration from and developers reviewing this and everything, then development becomes smooth sailing basically.

And this will become more and more important to the point even a couple of years from now where development will almost become instant. But the hard thing is taking these decisions, making these technical definition. Yeah, and one quick thing to add to that uh yeah is that going back to the ethos of Ethereum is that you should not be trusting, you should be verifying. But if you don't have anything to verify against, how do you know if the output of your co-worker or your co-worker that just delegated everything to AI is good enough, right? Like how do you evaluate that or how do you even evaluate like two agents competing to do the best outcome for a for a specific task? As Gory was saying, one of the things we started doing from

day zero is having sign tech designs and this is not only internally, but also externally with the partners that we work with. We need to make sure that before writing a single line of code, the thing that we're going to build is solid, is besides just being something good and well designed, it should be it should not break, it should be future proof. There is a word for this, I cannot remember it now. It should be anti-fragile. This is the designs that we are going to be building more and more and not only for critical software that we've been building for for so many years, but for most of the things that you would do because if you don't do that, you would just drown on technical debt.

Now, you might might be asking yourself, "Okay, you do take definition. Okay, you're very good at development. Okay, I saw you literally everywhere in ECC, in all the banners and everything, but what the Wonderland does?" Basically, what we do is foundational engineering. We partner up with a handpicked amount of protocols we believe in and we help them solve their hardest technical challenges. We partner up for the long term, for example, with Optimism and we help them solve interoperability in the superchain or custom gas tokens or with Aztec, for example, let's help them solve the standards, how a multi-sig looks like with private state.

I have tons of examples like that. We're a team of about 80 people. Most of them, the vast majority, software engineers. So, this is something that we're doing every day and like struggles with AI that we're seeing every day and trying to improve. Another cool thing is that you should not only wear one hat. You should always try to view things from different angles. The easiest thing you can do is just create a blue team, create a red team, and have them at it. Right? Like try Right now AI's AI is getting very good at quote unquote thinking. So, you can just leverage that. Obviously, you will have

more output that then you would need to digest, but I think that's way better than just like blindly kind of pushing through and kind of like brute forcing your way into a good quote unquote project. This is why in our process it's super important to be able to separate the team that it's designing or even like before designing that is thinking about this idea, then basically putting that into words, into reading documents with all the specifications that we just said, and then the team building and most importantly that the team writing the advanced tests and potentially attacks of the system that we just built.

Yeah, and some other teams are doing that as well. For example, Spark is doing a great job at separating and having like an internal security team and so on. And there's multiple like that, but you might be asking, "Hey, I don't have enough people to have an internal security internal security team. I might not have even the resources." And I understand. And you right now don't need that per se. Of course, it's an advantage, right? But first, use AI agents for that as well. Like leverage them. Use AI audits as well. Like not only at the end of the process, but at the middle of the process. And the also the developers of the protocol, like take out the hat of the developer for a week, put on the hat of an

attacker, and try to attack your protocol. Like just think of how you can break things. That's key to not having findings and not having findings in all these and not having really exploits. The other thing that we have been seeing for Yeah, for the past 12 months and it's going to increase is that before team leads used to spend little time organizing the tasks and also coding. Let's say 2080, right? 80% coding.

Now, more and more and you might be seeing this as well, the team leads are spending 50% organizing and 50% coding. And this is going to get higher cuz the power of AI is not code as much as possible, it's organize as much as possible. Take the best decisions you can. And you should optimize your team to take the best decisions to organize the interns that we were talking like the South and interns that just came through your door the best they can do. Yeah, so as Gore was saying, the most important thing here is obviously most of us just stopped coding and let's say some of us

specifically the CEOs out there or the business people or marketing people started coding as well. And the thing is obviously as a coder you do have a mentality on how things should look, how things work, right? We are all used to say, "I created you a new linear ticket with these things that you need to go and figure out and then design the system, etc., etc." So, you kind of understand the coordination needed as a single person, as a single developer. But as a developer as well, you don't understand the coordination needed to handle a team of 100 people or 1,000 people. And this is a new skill that we all need to to start developing as fast as possible.

Having said that, I'm the leader of I'm the lead architect and I love web3 and I've been like super excited about the space for years. I've been a software architect I know for more years than I've been for more than half of the years that I've been alive. Not more. The thing is as I was saying, if you're a developer, if you're a whatever a CEO, a business people, somebody that never touched code or even interacted with the way code is built, you need to shift your mentality. You are not a developer anymore. You should be thinking about how things are designed and how things are being thought

as well to be designed. It's like you need to go like three levels up on the metaverse to be able to kind of really understand why you're building things and how you're basically building your process for building things. This is might sound super complicated or maybe extremely abstract, but it's honestly fairly easy. You just need to ask questions and really think about the processes that you're putting in place and dumping the process that you have in your mind for the AIs to really understand and follow.

Yeah, and with what Skylar was saying, right? Like if you expect somebody to go into linear and write the specific task that you need to do with all the details that you need to do in order to build it, you're screwed. Like change your mentality yesterday. Like become an architect. Think about the bigger problem. Think about the why question. Why do I need to do this this way? Like And yeah, because if not, AI will replace you. But that's the power that we have. Like you need to get really good at coordinating, at making decisions, at thinking as an architect.

That's yeah, the key to basically staying relevant. So, as I was saying, leverage your AI. This is not something that say, "Hey, all your decisions should be taken by you or whatever." You can still leverage AI to do a bunch of things. And one of the things we've seen nobody's really using it for is just going out and scout and explore, right? Instead of just like blindly building things, use them literally as interns that just go and say, "Hey, can you like check what it what this is about? Can you check what that is about? Just like build me this, build me that." But as a proof of concept, that's something that follows a process that then you can decide on. Right? That you can just get

very very succinct information on the decision that you need to make and if that decision is sound or not, and then continue on that progress. Yeah, exactly what we were saying. You can easily read it. Like every engineer now becomes a manager. And you might be saying, "Hey, I didn't sign up for this." I apologize. Good morning. Like you didn't have a you don't have a choice. Like and it's extremely exciting. Like the amount If you ever write code, you know this. You know the feeling of taking a lot of decisions and being able to see the result in real life and how you can stay up until 2:00 a.m., 5:00 a.m., or whatever just shipping stuff, which is quite fun.

If you didn't experience that accelerating feeling, I really hope after the conference you go home and you write code something cuz it's really cool. Really. And anyone can do it. And yeah. Think like a manager. Start coordinating. Think like an architect. This is extremely important. So, three things to take out from this or from the AI side of things, write down your process. Like spend time defining your structure as an organization, as a developer, everything. Write it down. The AI will be able to leverage that and you'll be able to grab the South and interns and put 150 in this first part of my process, 300 in this other part, 400 in

this other part, etc. Separate the builder from reviewer. Now, avoid the AI slope. That's real and in the industry we work in, it's extremely important to be secure. You cannot forget that even for a second. So, put on your attacker hat and try to attack your protocol. And if you can, build your own internal security team. And three and most important, Yeah, protect your thinking time. And this is Yeah, I I think this is critical.

Most people will just spend way too much time just reading whatever AI vomits at them, right? Like all the logs, all the etc. It's like, "Oh, is this doing like good work or not?" And this is because you are the process. Your brain is the process and it shouldn't be that. You should basically remove that process from your brain, put it somewhere else programmatically programmatically verifiable, and just go and touch grass. Go and relax. Go and think. Let your creative brain juices work because that's your value as a human. That your value as a human is just getting context. If you need more context, you say, "Hey, can you please explain more to this?" Like Cloud and all the AIs are amazingly at onboarding people and and

explaining very very hard problems in your preferred way. But the most important thing is that you don't get sucked into the this black hole of massive amounts of data and information just because it's wow, it's super cool. It's like, "Oh, look at all of these logs, all of these things that it's doing." It doesn't really matter. Now, for the second part, we could do a fancy transition and say how AI impacts the privacy world and whatever. The reality is just that we had 40 minutes and we wanted to talk about both things, so we'll jump into privacy and why we think it's important and what we're doing in the privacy. So, if you came for the AI talk, surprise, you have a bonus privacy.

Okay, so privacy wise, as Gore was saying, we are a big team of 80 people and we were lucky enough to be end up working alongside the Ethereum Foundation for example on Kohaku, which is a private privacy by default wallet. The main idea of Kohaku is just hey, uh like interacting on the EVM should be private and that's it, right? Like if you do want to do things publicly, that should be a toggle, not the other way around. As well with Aztec, which we are building with them bunch of private smart contracts primitives. For example, how do you even reason about something very very simple as a private ERC, right? A private compliance ERC, a private multi-sig, a private lending market. I think that's a very very

tricky one, but it's like super interesting work that we're doing with them. And then as well with Jolt, which we are basically very very excited about because it's it's enabling us easier access and faster access and cheaper access to proving systems. And one cool thing about that about being in all the frontiers of privacy in the ecosystem is that we can have this cross-pollination and while working in Kohaku for example and working very close to multiple privacy systems, right? We can leverage that knowledge and everything we're learning and apply it to Jolt. And same for example with Aztec, like we see everywhere everywhere the real problems

that we're facing for example while implementing privacy. And we also see in the positive side of things all the impact it can have on the world, like all the thing it unlocks and I don't think enough people are realizing that which is pretty awesome because privacy is not a crypto feature. CK is not a crypto thing. FHE is not a crypto thing. It's an infrastructure primitive. It's something you can implement everywhere and something that we need to accelerate the implementation everywhere. For example this is incredibly surprising and this is only 2025, there were more than 3,000 data breaches for example in the world and

the average data breach cost a company about $10 million. Like only one data breach for example in the health care industry, I think it was in 2024 breached about 200 million data like data of 200 million people, which is four times the size of France. Basically, that's one breach. And companies of course are not happy about this and when we're saying privacy, we don't mean like users be saying hey, I don't want companies to see my data because the data is is being leaked and then I'm being screwed etc. Like companies don't want your data. That's the reality.

Companies don't want to hold your passport information, your credit card information. It's just a ticking bomb for them. And but before they needed to, they needed to hold this information in order to prove that you're over 18 years old. They needed to have this information in order to prove that you had a driving license or whatever. Let's replace that by CK proof for example, by FHE, but all the crypto primitives that we're working on. Yeah, so as Gore was saying, the problem is not the actual hackers or the actual data that you are sharing with for example, if you're renting a car, you need to give them a bunch of things that are extremely sensitive.

The car rental company doesn't do anything with it. It's not a value to them. It's just something that they need to ask you for compliance. And for them is this is a liability. As Gore was saying, the problem is not the compliance side of things, is that they don't have the technology to save this in any other way. And they're literally like scanning your passport making a photocopy that anybody can access. It's not like you would need like some fancy AI hacking tool to access data on most of these places.

And this will only became become more dangerous, right? With the advancement of AI tools data is at the risk of being accessed at the verge of being hacked. So this pri- privacy primitives that we're discussing about are going to be extremely important. We need to remove that data from there, but leave the proofs because they need them. Yeah, so um the amount of information the amount [clears throat] of information a company really needs from you is binary, right?

It is do you comply? For example, if you want to go into a bar, do you have more than the age required to enter? If you want to I don't know, take a credit out of a bank, do you comply with the things that they are asking? And this amount of data is just easily provable by with math. Math is not corruptible. Math cannot be bribed. Math is just there. So and it's extremely cheap to execute and to build on. The thing is the technology [clears throat] is here, right? It's just a matter of being able to ship one example that then the whole industry can can use and can adapt.

There are a bunch of companies already building really really cool things with cryptography, with encryption, etc. etc. And this is why we're putting a bunch of effort internally into going to jumping on all of these different new systems and verticals that we are very very excited about. One more thing is that this is not like some feature that's going to I don't know, make crypto a bit better. This is a whole new market whatever like there is a bunch of new companies that are being going to be created implemented CK in all the other companies implementing FHE, implementing CK TLS, like and crypto and web3 it's making a whole lot

advancements on the CK side of things specifically and CK TLS. The thing we're not seeing that much of yet is that being implemented everywhere in the world. Well Mhm yeah. I want to go into what happened with Google today. Yeah, I I can jump on that. So you probably know but Google has been doing a lot of research on quantum computing um and they just released that they hit major breakthrough. But for obvious reasons, they cannot basically prove that what they did is true. So how do you do that? Like how do you prove that something of value is actually valuable without revealing the

thing that it has value. And this Gore can can talk about this later, but this I think won some guy some cool Nobel Prize or whatever. Yeah, the the cool thing is that they just built a CK proof that proved the attack. They built a circuit with the attack and they say hey, you can verify the circuit, you can verify the proof and you don't need to see what's inside. And this besides just this quick example, this makes companies and everywhere else like more efficient because the less data besides obviously the compliance and the liability side of things, the less data that you have it also means that you can do things faster, things better, not be biased by other things

and just be able to coordinate better to have liquid ideas like flowing to be able to share private information and do computation on those private informations without having to leak them. Yeah, in the crypto industry in particular for example, there have been multiple experiments of white hats being able to prove that they can hack a protocol without actually showing that they can hack it in order to get the bounty and then disclose it fully. I think that's one vertical which is extremely interesting.

And it all connects to these guys like Can Thorau which said many years ago uh you cannot share an idea without actually sharing like you cannot tell how good an idea is without giving it away. And now the funny thing is that we can start doing that. Like FHE for example and the incredible work that the Sama guys are doing for example will allow us to do that. I think that's extremely interesting and exciting. Yeah, so another thing this enables is for you to quote unquote own what you have and for you to be able to prove that uh

let's say what you have is yours. This is very cliche and I think you you've heard it everywhere, but it's extremely useful not for you as a person, but maybe you as a company, you as a bank, you as somebody that needs for example to say hey I have this contract with this supplier, right? I don't want to leak you like how how much I'm charging the supplier, but I want you to know that I have this contract at least from a valid supplier that you trust. So can you give me a loan or can you like execute on this or can you do whatever financially or for example, you're going through a merger and acquisition, right?

So the company that wants to buy you says hey, show me everything you got, right? Good like meme from Rick and Morty. But you for your best outcome is obviously to comply, to show everything, but you are not ensured that the company will just say hey, okay, all good, sorry. And even if they signed an NDA or your basically critical company data is leaked. This is something that we don't see a lot of people working on and this is something that it's already be already available to be able to start I don't know, like pushing the industry forward with.

Yeah, not many people know that FHE is something that works already for example that's yeah interesting and well CK TLS as well for example one other clear example is Uber drivers like hey I do have plenty of reviews I've been working like 10 years as a Uber driver and this is extremely valuable to me how can I export that data and prove in another place that I have all these these are the things that this crypto primitive allows as well way way way more.

Yeah um kind of doubling down on this um and we added this specifically because of Wonderland and how we work and how we hire people um similarly there has been a study that says um that hiring becomes better when you see less information about the candidate uh that you're hiring uh besides just being {quote} more fair to the person it also analyzes and like it's very critical in analyzing the outcome of that hire and the productivity of that hire uh and this is something uh when we started Wonderland that we wanted to do uh you've probably seen us like we have very weird names like his name is Gorilla my name is Skeletor uh that's not the name that our parents gave us um but that's something

that we gave all the people that joined the company because we don't care who you are we don't care what you look like we don't care how old are you what sex do you have etc etc or what type of sex of sex do you have um we just care about what you do right we just care about your ideas the way you think the way you learn that's the important thing uh so being able to now besides just saying oh we kind of know like who you are because obviously for compliance reasons as an employer you need to have data of your of your employees but now if we had a system in which we don't have that the liability I have I don't really care about knowing your real name or where are you from or etc right I just care about that you're a legitimate person

that has a legitimate uh I know passport or whatever that you can work in a company and you're producing good work and I don't even need to know what good work you produced before I don't need to know if you worked at company Y Z or X I just want to know that you work at a company that I trust and that you did very very good work there. And similar to what happened with HTTP transition into HTTPS I suppose you're not seeing that many HTTP websites now anymore but before it was a thing like actually and the transition was extremely fast and why is that because HTTPS at the beginning was extremely complex

right to implement but then it became simpler you started seeing it everywhere you started seeing libraries and how to adopt it it became free also to adopt and to rotate the certificate and not only that but it became shameful to have an HTTP website for example in Chrome with the badge of hey this thing is insecure are you really really sure you want to go inside? That drove the adoption of HTTPS from 40% to 99% in only 4 years and I think right now we're at the 40% of well even less of CK and the transition is starting to happen now and it will be even faster with AI

because the rate of adoption and the rate at what you can implement complex protocols is way shorter right now so I hope even in less than 4 years from now we start seeing CK everywhere. Yeah and not only CK but all of these new primitives that enable us um to be able to do compute on private data uh for us all to just not even have to know that it's being used under the hood right uh like most of us well I know but a lot of people doesn't like don't really know like how HTTPS actually work like what TLS is or what

the hell like how does that get distributed etc etc uh and it will happen the same like most people don't know about CK or about fully homomorphic homo fully homomorphic encryption uh but they don't need to like just we need a very few examples and a very clear guidelines for just uh the entire industry to copy um and we need a little bit of shame as well we need somebody also like kind of pushing people to besides obviously the the economic incentive and the liability incentive uh we need a better um let's say better rules of the systems that we are using both from the government and from the users' perspective that are pushing

these companies or services to implement something that is best for everybody. Yeah we need to get to the point where when a company ask you hey can you give me your passport you're saying wait what like that's extremely like dangerous why would I give you my passport like I will open CK passport will give you the proof that you need so we need to get to that point we need to get to that shame that's way that way of companies asking for that much data that they don't need and as we spoke previously they don't want either. Yeah so um we are 80 people we are continue uh we are always growing we're always hiring so if you want to work with us uh

come join us at the booth is up here uh else just reach out through Twitter or website I will have the link uh in the in the last slide um and I think that the cool value of what we do is that we are not kind of siloed out and just um watching one thing uh we love having a holistic view on the ecosystem both from the privacy side of things but also from the uh I know DeFi ecosystem or or the other primitives and and verticals that we find are interesting and are will be a key part of the next years of society um we explain about this uh kind of three layers of the privacy stack from the user experience side of things

to how you actually build software that is private to how you actually prove software that is private uh and if you're interested as well in any of the things or if you're building any of the uh of these things or if you are wanting to integrate any of these fancy things with fancy words and you don't have literally no idea what to do please uh reach out we would love to talk with you. Yeah and if you see right now you're if you see your development is your bottleneck if you see you could use like a mega booster as of Wonderland do let us know like we work with some of the best protocols in the ecosystem and yeah if you are literally eager to work on the hardest problems in the industry

come to our booth to talk with us we're looking forward to meeting you. They are cutting the talk so we need to accelerate. Yeah there you go sorry we got very excited we didn't have a bunch of time to prepare this thank you all for for coming I think someone important is going to give a talk in a few minutes a very good friend of ours uh so yeah come come reach us come talk to us we love tackling really really hard problem and problems and thinking about very cool things uh yeah thanks all and thank you for coming to ETH DC hope you have a great time.

>> [applause] [applause] >> Come to a CTF if you're a Solidity developer as well. I don't think we have time for questions do we is there anybody no okay if you have any questions reach out bye.