Michael Lubas on the State of Security

<p>Michael Lubas, CEO of Paraxial.io and the first guest ever on this podcast, is back to check in on the state of security. We get into Microsoft's record Patch Tuesday, why AI keeps lowering the bar for attackers, the OpenAI sandbox escape story, and whether the AI labs are overstating the risk.</p><p>Michael shares why cheap foundational checks still beat a frontier model, why small companies should skip bug bounties, and why Elixir gets no credit for its security. Plus live questions from chat.</p><p>00:00 - Introduction</p><p>02:34 - ElixirConf US and the Hex pentest talk</p><p>06:20 - Microsoft's record Patch Tuesday</p><p>13:50 - Engineers who stopped reading their code</p><p>14:54 - LLMs as offensive security engineers</p><p>17:40 - Sandbox escapes and the OpenAI incident</p><p>23:00 - Are the AI labs overstating the risk?</p><p>26:09 - The open weights debate</p><p>29:32 - Developer anxiety and the Rails World keynote</p><p>35:00 - Why it's getting worse for defenders</p><p>38:30 - Run grep before a frontier model</p><p>41:11 - Why Elixir has an edge right now</p><p>45:21 - Patch windows in the AI era</p><p>47:11 - Can a startup stop a nation state?</p><p>50:06 - Securing your Elixir app with AI</p><p>57:17 - Letting AI patch production live</p><p>1:01:38 - Learning security as a developer</p><p>1:03:42 - Why small companies should skip bug bounties</p><p>1:04:54 - Insecure MCPs and AI assistants</p><p>1:10:14 - Verifying beneficiaries in Killswitch</p><p>1:12:36 - Q&amp;A: Simulating catastrophic events</p><p>1:13:25 - Q&amp;A: Learning ethical hacking with AI</p><p>1:16:22 - Kids, social media, and regulation</p><p>1:23:17 - Q&amp;A: Are garbage collected languages safer?</p><p>1:27:26 - Where to find Michael</p><p>Resources Mentioned:</p><p>- Securing Hex: <a href="https://paraxial.io/blog/hex-pentest?utm_source=elixir-mentor" rel="noopener noreferrer nofollow">https://paraxial.io/blog/hex-pentest?utm_source=elixir-mentor</a></p><p>- PortSwigger Web Security Academy: <a href="https://portswigger.net/web-security?utm_source=elixir-mentor" rel="noopener noreferrer nofollow">https://portswigger.net/web-security?utm_source=elixir-mentor</a></p><p>- The Web Application Hacker's Handbook (2nd ed.)</p><p>- Killswitch: <a href="https://killswitch.app/?utm_source=elixir-mentor" rel="noopener noreferrer nofollow">https://killswitch.app/?utm_source=elixir-mentor</a></p><p>Connect with Michael:</p><p>- LinkedIn: <a href="https://www.linkedin.com/in/michael