The next AI model might be too dangerous to release

Samuel Hill
Welcome to Mind What Matters, the podcast where we look at data security with just a little bit of the side of fun. Hey, cybersecurity is a serious topic, but we want to look at what matters truly. My name is Samuel Hill. I lead product marketing here at Mind, and I'm joined by Landen Brown, the field CTO. Landen, man, it's so good to see you. I know we've had a lot of travel, a lot of things happening in our world. You've been pretty busy, but Landen, what's going on, man?

Landen Brown
Not a lot, Sam. It has been certainly busy. Just as a company, you look at our just unique stage of growth. I think that's common between companies of our size. We've also had family events. The world's been busy. We've had a lot of travel and events lately. So I feel like it's been nonstop action since January 1st hit. And I feel like it's just going to probably continue that way throughout the rest of the year.

Samuel Hill
You know, it's like that movie, right? You see the trailer for the movie and you're like, this is going to be good. Sometimes, you know, they give away the entirety of the plot of the movie in the trailer. Like, well, I don't need to see the movie now because the trailer told me everything that I'm going to need to know about this story. But other times you think this could be a great action movie. I'm excited to see it. And then it turns out to be a period drama that has very little action in it at all. But nope, this year has absolutely delivered all of the action, the nonstop thrills.

Planes, trains, automobiles, some car chases. We won't say who was involved in that, but this is what it is.

Landen Brown
And I think even everything all the way down to the weather has been sporadic and chaotic at times, right? Especially where you're at, Sam, where I'm pretty sure you had like what, seven inches of snow and a moose in your front yard, and then the next day completely sunny and the snow is gone.

Samuel Hill
Yeah, currently, almost 80 degrees here in Montana, but we are expecting snow by the end of the week. So don't worry about that. Yeah, it's just make up your mind. It's going to be what it is. Well, hey, Landen, let's kick it off officially. Hey bud, what is on your mind?

Landen Brown
That's awesome.

Yeah, you know, it's been a busy—like, you know, continuing the trend—it's been really busy just personally. We've moved houses recently, you know, all within Idaho, not too far apart, but certainly felt the impact of just the world being more connected than it's ever been, both with the flow of information and the flow of the economy and the world economy and just geopolitics in general. Just, I mean, moving into our house, closing on our house, was right at the start of some of the geopolitics in the Middle East. And we certainly felt that with the rates in the US and oil prices and all of the things. And we have coworkers in Tel Aviv. We have coworkers all around the world. And so really just, I think, for me, top of mind is just how—I think fragile is the wrong word. But something akin to the fragility and also the interconnectedness of just everything in the world right now, of how things on the other side of the world have a direct, direct and noticeable, tangible impact on us on the other side of the world. Definitely felt that as we're getting, we're getting, you know, moved in and settled and, you know, with the resolution of that chaos of moving, I'm sure something else will come up and, you know, we'll move into another fun project for the family. But definitely been a busy start to the year, both work-wise and personal-wise for the Brown family. How about yourself, Sam?

Samuel Hill
Congratulations on closing and then now getting moved into the new place. I'm hoping it'll be a great fit for the whole family and lots of space and lots of things for the facilitation of the growth as you guys continue to—your kids get bigger. That's one thing, they never stop growing. They always want more groceries. They continue to get new clothes because they get bigger, and hopefully it'll be all really great for them. But what's on my mind is obviously getting into the summertime, all the activities and all the things that are coming up. And

Landen Brown
Yeah, thank you.

Samuel Hill
Do you have this issue too in your family where the family calendar, sometimes there are crossed wires between—you know, my wife and I are the main planners of things. My wife is the main planner of things. Let's be truly honest. Sometimes the wires get crossed. So having those conversations upfront and early of, "Hey, this is what I know. Here are the big blocks. I know I have this thing going on, this thing going on. You have this thing, you have this thing. We have these things as a family," getting all of the dates lined up is such an important and underrated conversation to have as a family.

Landen Brown
You know, Samuel, your kids are—my oldest is 10. How old is your oldest, Samuel?

Samuel Hill
Yeah, she's 12.

Landen Brown
OK, so you have two years' head start on us. We just established a family calendar. And I hate to say this on a podcast that people will hear, but we had to start coordinating and planning our family calendar around what kids are grounded and when. And when you have five, it's really important that the kids learn the lesson from start to finish. And if there's wiggle room in that or there's gray area, they don't learn the lesson, and we want them to learn the lesson and be better people so that we don't have to ground them ever again for the same thing.

So we have to coordinate strike calendars and family calendars and who's grounded and who's not, what are they grounded for and add notes for why so we can reinforce it at the end and then start. And that was actually the genesis for why our family calendar started. And now it's finally blended into, "Hey, what do you want to do this weekend? And what am I doing next weekend?" And we're getting more organized as a family, which the benefit is we're getting better as a family, but I feel like sometimes we're getting better a little too late.

Samuel Hill
Right, right.

Yeah. Well, hopefully your kids are getting grounded for new reasons. That's obviously the goal of parenting, right? We've tried a lot of different family calendars. None of them released that. Currently right now it's a whiteboard on the pantry door and we just kind of keep it week to week. And my wife will ask, "What's going on with this thing?" I'm like, "It's on the calendar." "I don't look at that." "Okay. That's the entire point of the family calendar is that we both are able to look at it and react and do that." We're

Landen Brown
Yeah, yeah.

Okay.

Samuel Hill
still figuring it out as well, not that we have a perfect system here. But I'm going to add the who is facing which consequence at what time and for how long. That's a good call.

That's awesome. Okay. Hey, let's dive into a lot of things happening in our world as we mind the headlines. All right, first up today, Landen, obviously I think there's a lot happening around Claude Mythos, the new model release from Anthropic. Now I use Claude almost exclusively now. I mean, it is really burst onto the scene as one of the more popular LLMs, coworking tools, maybe Claude Code, Claude Cowork, Claude Chat, all the things that it can do.

It's hyper powerful. I mean, I probably have it connected to almost every part of my daily workflow nowadays. And we have other models that we use. I use Gemini pretty regularly. I use the ChatGPT models pretty regularly, but Claude has exploded and their new model Mythos is coming out. But wait, wait, wait, we can't release it yet because it is too dangerous. It has too many latent abilities to chain zero-day exploits and become incredibly disruptive.

And it's really neat to see an organization actually take a look at, "Okay, we built something. We think we built it responsibly, but wait, maybe this needs to actually have some testing before we release it to the general public." So super interested to see Claude Mythos and its abilities. Some things get leaked online. This was obviously a huge thing that happened in the AI LLM world. But the question at hand that I'm going to ask you today, Landen, is what's your opinion on the Mythos announcement?

Landen Brown
I feel like it's one, a pretty smart positioning, right? It created a significant amount of buzz in the market. I mean, we're talking about it. I think everyone's talking about it. And Anthropic just had a massive brand uplift based on that simple announcement of "Hey, we've got something but we can't give it to you yet." I think it's also smart for the industry overall, right? I think looking at—we've all seen, you know, Terminator movies and movies like Her where technology moves faster than responsibility, and I think Anthropic for once has modeled what everyone should be doing, which is, "Hey, we've got something. Let's really think about what we're giving out. Do we really want to give it out? And is this safe if we do?"

And I think that's a really interesting narrative shift in the AI space. I know that OpenAI has done the same with their O-series models, with the O3 model. I think Google with DeepSeek as well. Everyone's starting to put out these pre-announcements of "Hey, we've got something really powerful, but wait, we're going to test it first." And I think for everyone personally, professionally, and for all of us as cybersecurity professionals, that narrative shift is very, very good.

Samuel Hill
Yeah, a little bit more critical thinking before we just release something that is obviously going to just shake up the industry. You had mentioned the ChatGPT O3. Crazy abilities. Absolutely. I mean, I've seen some of the coding output. I've seen it go through some insane reasoning. Obviously, the way that it constructs a proof for anything you want to query it is pretty amazing. And it's a great concept.

And, you know, for such a long time we've been waiting for that AGI moment. And all of a sudden, wait, we might have models out there that can actually start achieving AGI status. You know, I think we're seeing this in that particular case. Like, "Oh, AI, it's always coming. It's never here, but it's always almost here." And I think we're probably getting to this point where AI is here. We're just going to have to deal with it in a more permanent fashion than what we've probably thought about before.

Landen Brown
Yeah, I couldn't agree more, Sam. I think what we've seen historically if you look at over the long spectrum of history, right, when something like this happens, we look at it with a rose tint for too long, meaning we're a little too optimistic, we're a little too excited about it, it's the flashy new tech thing. We're a little too positive and optimistic and as a result we hold off on regulation or policy or people thinking about the direct and just honest risks that could come from that level of capability. And I think we're in that exact state today. I think we've got this tech that just unlocks so much possibility. And again, it's just infinite. We could just keep dreaming about what is possible.

But there's a whole other side of that. And I think every single individual on this podcast listening and even myself should take that just a little more seriously. And I think Anthropic is saying, "Hey, we're taking the capability of what we've built a little more seriously this time."

Samuel Hill
Yeah, good call. All right, our next headline. Actually, I want to know if I've framed this conversation wrong. It is Claude Mythos or is it Claude Mythos? I don't know.

Landen Brown
So it's funny. I have a philosophy that if there's different pronunciations of a word and everyone seems to understand it, just say it with confidence. It's fine. That is the beauty of a dynamic language. So however you want to say it.

Samuel Hill
I like that. I like that. That's very good advice. Okay. Mythos. Mythos. For either one, if you would like to use it, just say it with confidence. You're probably going to be fine. You know? All right. Next headline for this week. New study indicates that nearly 30% of all industrial facilities worldwide could be vulnerable to cyber attacks because of outdated software, systems, unsecured networks and all sorts of things like that. Obviously, we've all seen the Stuxnet movies, read the articles, seen what the Stuxnet virus did to Iranian nuclear facilities and how scary that was.

But what about this near 30% of the industrial facilities? And you've had experience in this world, Landen. I want to hear your take on what you see as a big takeaway from this study of all these OT vulnerabilities.

Landen Brown
Yeah, I think for me, the one that's just absolutely mind blowing is how different OT architectures and operational technology architectures are than enterprise technology architectures. They're both just vastly different spaces. And they both should be secured, but they have different security requirements, right? In OT, the equivalent of acceptable security loss in OT would be someone dying or it would be a piece of critical infrastructure being destroyed or not functioning. Very, very high stakes, right? Whereas in the enterprise space, okay, we've got some downtime of a web server and maybe there's a loss of revenue on a per-minute basis. Those acceptable levels of loss are just vastly different and the approach to security is fundamentally different because of those thresholds.

And I think people underestimate the level of security needed for OT systems and the level of investment needed in OT systems because both people and facilities and people's lives are on the line with the security of those systems, Samuel.

Samuel Hill
Yeah, I think that is a critical point. I mean, in enterprise, you might have some downtime, right? Whatever. But if a dam fails or an energy grid gets turned off or a nuclear facility has a catastrophic failure, yeah, we're not just talking about the maybe thousands of dollars of loss. You're talking about thousands of lives on the line. And so super critical. And I think a fascinating call. But the headline that I see here, Landen, is 30% are vulnerable to cyber attacks. And that means 70% are not. And so it seems like more than half the facilities know what they're doing and are responsibly thinking through the architectures of how these systems are going to be deployed.

Maybe that's half glass full looking at it that way, but still 30%. Whoo, that is a big number for such critical infrastructure.

Landen Brown
Yeah, agreed. I think the other thing I also learned from this report, and I don't know if you dug any deeper, but as I dug deeper into the actual report, they also start calling out things like supply chain risk for OT facilities. Not only do you have a threat of a direct attack on the OT facility, on the OT environment, you also have the supply chain where that OT facility is both an input and a supplier. And so you have that risk on both sides where a cyberattack on a supplier or a customer impacts the flow of goods, the flow of products, and critical infrastructure going on there. And so I think that risk extends beyond just 30% of OT facilities into the supply chain, which is 100% of OT facilities.

Samuel Hill
Yeah, maybe even 130% because obviously, some OT facilities could have more than just one or two suppliers or one or two channels in which they're getting products or moving products down the line into different facilities, other products. Yep. 100% agree. I mean, I've gone deeper into the report. I've seen a lot of those calls and I think that's a pretty critical insight. Really. All right. Mind blown moment for today's episode. Landen, what are you bringing me? What has been rattling around in the back of your mind here?

Landen Brown
Yeah, you know, I was at Gartner recently, Sam. It was right before we recorded this episode, and one thing that I kept thinking over and over again in my mind as we were talking to CISOs and all of these security leaders was this rise of more and more vendors in the space and vendors competing against SIEM and also vendors wanting to just have one last meeting with a prospect, right? We're in a very competitive space, very competitive environment. But one thing that kept popping up is as people are seeing more and more events, there's this deluge of data that they need to make decisions on, right? And everyone's in this position where either they're building agents, they're using agents, or they're being told they're late on AI if they're not using agents.

And so I think people are all in this position where they want to leverage AI, right? But they also don't know how. And so people are using agents to make sense of the data and to delegate decisions. And as I talked to person after person, CISO after CISO, I talked to them about what they're using AI for. And the one thing that I kept getting back was an answer of, "Hey, we're using AI and agents to help reduce our workload, and it's helping, but there's all this weird stuff that's happening that's not documented. So if I have to hand off this agent to another person, they really don't know how to use it."

And I think there's this trend of shadow work or work that's happening that's not documented, work that's one, not auditable, and two, not transferable. And so one person might be using an agent or using an AI solution to do their job, and then when they leave, that part of their job just doesn't happen anymore because it was a Frankenstein solution that they put together with some agents and it's not transferable. And I think this is just one of those things where I look at what we're building at Mind, it's going to matter so much over the next two years where autonomous systems in cybersecurity actually are documented, transferable, auditable, and we can actually train people on them. I think that's going to be a massive problem that we're going to see develop.

Samuel Hill
One, congrats on a great Gartner show. That's fun to get to see a lot of people. Two, I think that leads into this concept of the idea of documentation. There was a time in which an organization would provide a system and they'd say, "Here's the instruction manual. Now you have to go through this 300-page document of the instruction manual in order to learn how to use this or learn how to facilitate the workflow of the system at hand." And then the idea was, "Wait, wait, wait, we can digitize this and streamline this and make things much more efficient," and sure enough we can.

And now you have AI, which is streamlining the process so much so that it works, but the why it works or the actual documentation behind the why is non-existent, meaning there's no audit capability. So super fascinating. To your point of the transferability, auditability, and knowing what's happening, there's this term "vibe coding" which is going around, which is basically like, "I don't really know what's happening, but I know I give it a prompt and it spits out the code and the code seems to work, so I don't need to know how it actually works to get to the end result." And I think that goes back to what you're talking about. It's like there's now this layer of abstraction. I don't understand what's happening, but it's solving the problem, so great. And as soon as that person leaves, the context of how the problem was actually solved is now gone because they're not there and nobody else knows what's happening and the agent itself won't be able to tell them.

Landen Brown
Yeah, exactly. Yeah. And I think there's, there's this just massive, I don't want to say crisis, but I think there's a problem looming on the horizon of, you know, from a legal standpoint, from a regulatory standpoint, from an auditing standpoint, if your answer to the auditor is, "Well, the agent does it." That's not actually a valid answer. And I think we're going to see so many more and more of those scenarios happen, especially in, hey, we need to have processes, we need to have policies, we need to have standards, and all of that actually can impact people's careers and job security when an auditor comes back and says, "Hey, you're actually not compliant because I can't actually see and audit how an agent is doing something."

Samuel Hill
Yeah, "trust me" is a very quick way to get a lot more red flags added to the audit report. And so yep, that is incredibly fascinating. That's a really good call. All right, our mind-blown stat for this episode is in honor of the Artemis mission, which recently returned from its trip around the moon. Pretty cool to see humans again advancing beyond Earth's orbit to another celestial body, one that orbits our planet here.

But if you folded a piece of paper 42 times—42, just 42 times later—that's all you got to do. Fold a piece of paper 42 times. It would reach past the moon. And I was like, "Wait a minute. Nope. That can't be true. That cannot be true." But the math checks out. I've—I'm no mathematician by any stretch of imagination. And in fact, if you knew me well, you would realize how funny it is I'm talking about a math equation, but that's a story for another time.

Landen Brown
Yeah.

Samuel Hill
But 42—obviously the physical improbability, MythBusters did test this. They could not physically get a piece of paper to fold 42 times. The secret is, every fold doubles the volume. So, you know, you fold it in half once. Now you have to fold it again. Now you have four, eight, and logarithmically up from there. Eventually you get over 400,000 kilometers, which is just past the moon's orbit. So in honor of Artemis, maybe go fold a piece of paper a couple of times. See how many you can get.

Landen Brown
You know, Samuel, I feel like this is an opportunity to have Claude write a new book for you that's for founders and tech founders called The Rule of Folding 42 or something that teaches them how to 42x their business. And maybe it's time for a witty LinkedIn post at the same time.

Samuel Hill
That's right. Thank you. You've just started my new LinkedIn series. What I learned folding paper 42 times. Comment AI to get my playbook. It'll be so, so good. Well, Landen, hey, as we wrap up today's episode, this has been a fascinating conversation, but let's focus on what matters now. And for me, I think, you know, Mythos or Mythos, however you say it, you know, I respect the marketing hustle, right?

You know, you mentioned it. While their IP got leaked and now all of a sudden this new model is so powerful, we can't release it. And, you know, it's such a good marketing strategy. You know, OpenAI is copying it with their new model saying, "Hey, we got to, you know, let's get it tested in the industry first." And, you know, hey, respect the hustle, I get that. But also maybe it's good that we can have some forward look into models and see what they're capable of before we just unleash it on the wild. But at the end of the day, AI only works if it has access to data.

We've seen this. Every model has to be trained on something. It's not creating out of thin air. It is trained on existing data. So as an organization, what matters now is if you have a handle on your data. And shout out to the research report we just published where security leaders actually talked about this conundrum of AI uses my data, but how much control and operational governance do I have over the data being used by AI? Available now on the Mind website. We'll link it in the show notes.

But getting control of your data as an AI model interacts with it, to me, is what matters now.

Landen Brown
Yeah, I couldn't agree more, Sam. If you look at the genesis of models, it is data, and the output of those models is either action or generation of data. At the end of the day, I think what we all understand and are starting to understand more and more is that if we're not protecting data, if we're not governing data, if we're not securing data, if we don't have good compliance and regulatory control around data that applies to both humans and agents, then we're leaving ourselves open to a massive amount of risk, more and more every single day. I think the one thing that matters now is that we start seeing that as a scale. And every single day we're not doing something about it, it's every single day that that scale of impact potentially gets bigger and bigger and bigger when we're not addressing or securing data or keeping that at least top of mind.

Samuel Hill
The more the world changes, the more it stays the same at the end of the day. Your organization has something unique about it, which is probably data related, some IP, some process, some thing. The KFC secret recipe or the Coke recipe, it's data, it's secret. Keeping it safe is a very high priority to maintain whatever competitive advantage you want in the organization. So let's keep our data safe. And that's something that I think we care about here at Mind.

So let's go forward from there. So hey, Landen, let's close off like we do every single episode with what did you learn today?

Landen Brown
I think personally, Sam, what I learned today and something that's a theme over the past week is just one, being adaptable as a person and as a world, right? I think we're moving into a world where everything's so interconnected. There's so many things that can impact us at any given time, both personally and professionally. I think really building the resilience to be an adaptable human being and being an adaptable coworker, being an adaptable parent, being an adaptable professional is going to matter more than ever. And I think that is very much what I'm learning today, what I'm learning this week, and something that, again, will probably stay top of mind throughout the rest of this year.

Samuel Hill
Yeah, to that point, I mean, as we're recording this episode, there's currently a ceasefire happening in the Middle East across many of the involved parties. And I know leaders from involved nations are traveling to continue negotiating. Our prayers and thoughts are for a safe, peaceful, and prosperous resolution to any conflict happening in our world. So, and yeah, I've been also checking my own privilege of, I haven't been able to get ahold of so-and-so in our product organization because they've been literally fighting a war. So maybe a little more grace for some people who are fighting battles, whatever they are. Hey, what I've learned today is that there is no good family calendar. So maybe I'll wait for Claude Mythos to get out and use it to vibe code something that might actually work for my family. I don't know what that will look like, but I'll keep you posted on my results. I'll build in public. I'll post it on LinkedIn as we build in public, the family calendar based off of whatever this new model can do.

Landen Brown
Yes. Great point.

Yeah.

There you go.

Connected to all your data at the same time.

Samuel Hill
Exactly right. I mean, what's the worst that could possibly happen? So all that to say, Landen, thanks man. That's been a fun conversation as always. And congrats on the new home, and I look forward to visiting it someday soon. So for Landen Brown, my name is Samuel Hill, and that's all for now.