Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

fun panel yesterday to kick off @AISecSummit in SF, an unfiltered look at what's happening hacking is democratized, and only way for defenders to keep up is with more compute but so much has to be built to make it work some things at inception i'm thinking about - the physical frontier - who's securing the data centers and neoclouds, and the next headache will be billions of new intelligent devices coming online 👀 thanks @dee_bosa for moderating with @mnair1 @snyksec @JohnHultquist + Michael D'Angelo @OpenAI

Engineering leaders told Grepr founder and CEO Jad Naous they spend 5 to 20% of their infrastructure budget on observability, and it's buying less and less reliability. Jad, a former a16z partner, joins a16z's Martin Casado to discuss whether AI can run production systems as well as it writes code. Grepr sits in a company's log stream, can scan a petabyte of logs a day, cuts observability costs by about 90%, and is building AI agents that use those signals to troubleshoot production issues. How AI is changing engineering at Jad's 10-person company: - A data lake feature that once took one engineer about six months took Jad 10 days - The gap between okay and great engineers on his team "just multiplied 10X" - He runs 3-4 agent sessions at once, with a "tech lead" agent reviewing every PR Why running live systems is a harder problem for AI: - Jad: AI can almost tune databases, but can't yet keep servers running on its own - Martin: every bit of code doubles the ways a program can behave, which is why humans still own systems - The real world is messier than AI's training data, self-driving took 20 years and $170B 0:55 From Stanford to a16z to Grepr 7:00 Why observability spend stopped paying off 11:00 From autocomplete to AI that trains engineers 13:10 Why AI widens the engineer skill gap 14:55 Syntax vs semantics 18:00 Inside Jad's AI workflow 22:55 Six months of work in 10 days 24:50 Can AI reason about how systems really run? 30:10 Why AI SRE tools start in the wrong place 32:30 Can AI run a distributed cluster yet? 37:35 Why engineers buy extra capacity over predicting 39:15 How AI could trace failures in production 43:45 Why AI for ops is harder than for code 49:55 Can AI do a VC's job? 52:05 Why self-driving took 20 years and $170B 57:05 Customers skipped the AI pitch for the 90% savings YouTube: youtu.be/blkIGLlZePg @jadtnaous @grepr_ai @martin_casado

fun panel yesterday to kick off @AISecSummit in SF, an unfiltered look at what's happening hacking is democratized, and only way for defenders to keep up is with more compute but so much has to be built to make it work some things at inception i'm thinking about - the physical frontier - who's securing the data centers and neoclouds, and the next headache will be billions of new intelligent devices coming online 👀 thanks @dee_bosa for moderating with @mnair1 @snyksec @JohnHultquist + Michael D'Angelo @OpenAI

We've spent a lot of time at @KeycardAI thinking about how authentication and authorization need to evolve as agents take on more work. API keys and OAuth scopes were never designed to account for tasks, delegation between agents, or agents acting on their own. I wrote about how we're approaching this and what we think needs to change. keycard.ai/blog/defining-aut…

Today we're publishing the first draft of the Agent Baseline Software Factory Reference Architecture! An opinionated blueprint for securing increasingly autonomous software factories, built with folks across the community. It's open for feedback and contributions! agentbaseline.org/reference-…