Kelsey Piper says her AI cyberattack skepticism aged badly amid three recent attacks; Nathan Lambert pushes back
Kelsey Piper says Nathan Lambert's skepticism about AI-enabled cyberattacks has aged badly after three recent incidents, including a CrowdStrike-attributed hack of South Korean banks using an AI agent. Lambert responds that at least one attack likely wasn't AI-driven, that ARTEX was open-source software but not an LLM tool, and that closed models seem at least as unsafe. Only one attack has been formally announced. Lambert frames the debate as a litmus test between threshold and diffusion views of cyber risk; Piper says she doesn't know anyone at a lab who holds his 'group 1' view and asks for examples.
All posts · 21, most important first
- I think this was an interesting point to make but has aged incredibly badly with three significant likely AI-enabled cyberattacks in the ten days since it was posted. reuters.com/world/suspect-… , npr.org/2026/10/15/nx-…,@natolambert: In case you missed my hot take yesterday. open on X6 likes · 0 reposts
- These cyber attacks at least partially aren’t due to ai (horrible security on the fridges) and generally are within ranges of “fine” for me. With new technology we should expect bumps, but we want the transition to be consistent and not too unbalanced in power.1 likes · 0 reposts
- Yea sure, but I don’t think there’s evidence that open weights are leading the damage here. Seems like closed models are at least similarly unsafe to date4 likes · 0 reposts
- I feel like this is a litmus test for if you think either: Group 1: closed models are safe, cyber risks is mostly a threshold Group 2: different models have different safety risks, and cyber safety is a messy diffusion process Most people in AI labs are group 1@natolambert: In case you missed my hot take yesterday. open on X11 likes · 1 reposts
- I don't think I've talked to anyone at any lab who believes 1. Can you give an example?0 likes · 0 reposts
- It was very fair to go "hey, we're hitting the point where we should be seeing open source AI enabled cyberattacks at scale, where are they" but I think the answer is in fact "yes, we're seeing them".2 likes · 0 reposts
- This is open source software right - I don’t think ARTEX is an open weight llm based tool.0 likes · 0 reposts
- correct, sorry, it's open source but it's not an LLM tool at all, was just used in conjunction with them. (also its creator took it private after the 9 bank cyberattacks).0 likes · 0 reposts
- What would you expect to see as evidence if open weights were leading the damage, aside from a big upsurge about when open weights models got sufficiently powerful?0 likes · 0 reposts
- the "apocalypse" framing is sort of nondisprovable, no one was claiming an apocalypse. if the global damages from cyberattacks rise, idk, 100x in the next year, would you count that as "more or less fine"?6 likes · 0 reposts
- I expect most cyberattacks that do large scale damage to be attributable to both AI *and* poor security! I agree of course that a higher rate of cyberattacks is just a cost to be considered alongside benefits14 likes · 0 reposts
- I agree that the goal isn't zero cyberattacks. I disagree that we won't see disproportionately many; I think we clearly are seeing disproportionately many!3 likes · 0 reposts
- sorry, maybe I'm missing something but that combo doesn't make sense to me; aren't losses what insurance costs are supposed to estimate?2 likes · 0 reposts
- (And there isn’t signs that closed models are getting safer fast enough)2 likes · 0 reposts
- okay, fair, that's much higher than I expected and so has much less room to grow!1 likes · 0 reposts
- okay I also am not familiar with a distinction between rates and premiums!1 likes · 0 reposts
- in another reply thread someone proposed whether cyber insurance costs or damage from cyber risks 10x in the next year1 likes · 0 reposts
- seems super reasonable. I think I basically do expect these to 10x or more over the next year (and would be worse without the hardening of the last several months)1 likes · 0 reposts
- I don’t think the increase of cyber attacks is proving it wrong, it’s proving the stakes of the debate and societal preparation.0 likes · 1 reposts
- the other two I think the investigation is still ongoing0 likes · 0 reposts
- the first one that has been formally announced:
0 likes · 0 reposts
@kelseytuoc press · 
@natolambert research ·