Open-source models trail closed ones by about six months

Transcript

From the transcript TBPN publishes with the episode.

1. 3:41

   But there is some cause for optimism, you know, much like the broader secure... Cybersecurity scare that happened back in March of this year, there's a gap between closed source and open source models. Most people say it's around six months. You know? The capabilities catch up in certain areas. It seems like it's faster. Sometimes it's three months, but six months is sort of a useful heuristic I have And that actually maps out pretty pretty perfectly with the most recent news. So if you remember, Mythos Preview was dropped by Anthropic on 04/07/2026. It's the fourth month of the year. And then CrowdStrike announced that a 26 year old in China used a open source Chinese developed AI agent to execute cyber attacks against South Korean banks on October 7, like the same...

2. 4:35

   I think that the report came out October 7. So it's basically just exactly six months later, you see, like, a open source model be used in a cyber attack. Fortunately, the the the the banks have, you know, a ton of redundancies, the ability to roll back transactions. They store things to tape. They store things on paper sometimes. There's a lot of different ways to secure a traditional bank that is not purely digital, even though they might have a digital front end and a lot of the money might be stored digitally. And the interesting thing is that when I read at least about one of the South Korean bank cybersecurity incidents, it was a pretty small amount of user data that was stored. It was like names and addresses and, like phone numbers of, it was a significant number. It was like tens of thousands of clients or something like that. But it wasn't like they robbed the bank and they got the money or they got everyone.

3. 5:31

   Somehow they got into, like, one system for information. So it could have been like they they hacked into, like, their paperless post account. That was like the... What the bank used to send out invites to clients or something like that. Like, there are a whole bunch of different systems and and where... At what level did they get in is is important, but it's clearly happening.

4. 5:50

   They got into the client gifting software. They they everyone chocolates. Maybe. Maybe. And so, obviously, you don't want hackers anywhere. And so cybersecurity is more important than ever. And so the crypto community does have, you know, a couple months to go bunker mode as they are putting it. And it feels like there'll be an incredible amount of progress on these, like, AI proofing systems, but it's an entirely new challenge. It's less... Much less understood than quantum computing, which has been theorized mathematically and sort of formalized for years before the capability came. This is different because we're getting this capability before we've really characterized the shape of the threat. Like, they know with quantum, like, there's something called Shor's algorithm, and, like, they gotta fix that.

5. 6:37

   So they gotta make sure that Shor's algorithm doesn't work to break Bitcoin wallets open. They know the mathematical problem. They gotta solve that. In this scenario, it's like there might be a different algorithm that runs on commodity hardware that works. And how do you know when you don't know the shape of the threat that's coming? So, it's a crypto apocalypse potentially, but the market doesn't think it is. Bitcoin's only down 3% today, and it's still up 3% for the month. And so the market is digesting this and optimistic. There's still lots to do if you work in crypto. And potentially, even if you only own some crypto, there's things to do.

6. 7:15

   Vitalik gave some recommendations on don't panic, but also maybe start thinking about this more intently. He said, I don't recommend anyone scramble to move their funds to new wallets today, but we should take the risks of cryptography from AI accelerated math seriously and minimize our exposure to not just quantum vulnerable cryptography but also AI vulnerable cryptography. The new core area of risk from this viewpoint is unfortunately MLDSA, FAG, lattices, and this is also another reason along quantum why ECDSA might fall even faster than expected, hence the fresh address recommendation. So far, people have been in the mode of thinking elliptic curves broken, hashes safe, lattices safe, but there's a good chance that the concrete security of lattices will take serious hits from the next two years of AI math. And so some people were were posting Scott Lou here was saying, oh, that's weird.