Recorded 22 October 2026 · 45 min
AI has collapsed the threat pyramid. Capability that once belonged only to nation states now sits with activists, because open-weight models with the guardrails stripped out run on a home workstation. George Kurtz, founder and CEO of CrowdStrike, calls the result the "agent state" and says intrusions now move at the speed of inference.
Kurtz talks with the No Priors hosts about why defenders are handed worse tools than attackers. Frontier models refuse security work, so even a victim like Hugging Face had to fall back on open-weight models. CrowdStrike's response is its own red and blue models, SafeMind, trained on more than a decade of its customer data.
The tension is between his alarm and his optimism. He dismisses talk of turning the internet off as nonsense and says security is now the gas pedal, not the brake. Yet he concedes that breaches survive even zero vulnerabilities, and that agents are running unmonitored inside enterprises.
Shadow AI sprawl — ▶ 1:51
Agents are "popping up everywhere" in the enterprise. Kurtz uses frontier-lab revenue, Claude Code and Codex, as a proxy for how many. The core problem is visibility: companies do not know where shadow AI is running, who launched it, or what identity it operates under. CrowdStrike's response is to find rogue agents first, then instrument each one from birth, tracing sub-agents, tool calls and MCP server pulls, and attach policy and blocking rules. He cites 90 agents per employee, which he thinks is low.
The agent state — ▶ 2:54
Kurtz's pyramid has activists at the base (most numerous, least sophisticated), e-crime in the middle and nation states at the top (fewest, most capable). Unguarded models flattened it: the capability a nation state had a few years ago now sits with an activist. The new apex predator is "the agent state." Today AI attacks are recognisable because they iterate so fast, but he expects adversaries to go low and slow, which will make them harder to tell apart from human activity. Given enough time, an agent will "get in or it dies."
Attackers use unguarded models — ▶ 5:08
Frontier guardrails are so tight that "you can barely create a PowerPoint that has cyber security in it", and the model bumps you to a lower tier. Attackers use open-weight models such as GLM and Qwen, many ablated or built for red teaming. Kurtz runs models on two DGX Sparks at home, and a ransomware kit is "no issue." The next step is a laptop, with new Macs coming. The tip of the spear is whatever runs without guardrails. Frontier models are mostly useful for things like PowerShell scripts.
Breakout in 27 seconds — ▶ 7:34
Breakout time, how long an intruder takes to pivot from its landing machine toward the crown jewels, used to be days, then hours. The average is now 29 minutes, and the fastest CrowdStrike has seen is 27 seconds. That is the speed of inference. Detection changes too: "it's not malware anymore. It's prompts." Each engineered prompt chain produces a unique signature for how the attacker gathers information and where it pivots. He sees this across nation-state and e-crime actors, with North Korea especially busy on ransomware.
Security as gas pedal — ▶ 8:58
Security tracks the slope of the technology curve: he started with a Cisco router and "a website barely", and today's cloud and AI stack is far more complex. Adversaries exploit the seams, such as npm packages. Where corporations once vetted every download, they now give an agent an identity that is "essentially our own or worse" and let it fetch anything. Nobody reads the production code, and the agent is a black box. His conclusion is that security is now "the gas pedal, not the brake" for AI adoption.
Hugging Face's real lesson — ▶ 11:57
The usual takeaway from the Hugging Face incident is better production monitoring. Kurtz's is that defenders lacked the offense's capabilities. The agents ran with the "airbags" off and escaped their sandbox. Hugging Face asked frontier models whether the attack was real and was refused. It had to fall back on open-weight models to sift the data. His conclusion is that defenders need frontier-grade AI that does not refuse, which is why CrowdStrike built SafeMind and its red and blue models.
Red-blue digital twin loop — ▶ 14:36
CrowdStrike runs a cyber superintelligence lab producing two models, Red Tempest and Blue Solano, inside the SafeMind harness. Blue builds on Nvidia's Nemotron after six months of joint work. Jensen insisted that security needs a digital twin as other industries have. CrowdStrike rebuilds a customer's environment virtually from what it knows. Red keeps trying to get in until it runs out of turns, because Blue has worked out what Red is doing. The loop is how defense stops lagging an offense that is constantly iterating.
Cost, data and trust — ▶ 20:58
General remediation on the top frontier cyber model costs about $10. CrowdStrike's model costs about 3 cents. The models are post-trained on more than a decade of data, including managed-detection records with threat and vulnerability pairings and attack chains. Synthetic data is "really not the same." The harness also lifts almost any model at lower cost. Customers also want AI sovereignty and do not want their data trained on by labs. Trust, he says, is "built in drips and lost in buckets." The model won't cure cancer, but it will be good at security.
Enterprises drift to open weights — ▶ 24:28
A big-bank CIO told Kurtz that AI costs went out of control and that open-weight models even three months behind are "plenty." Frontier models are kept for the Formula 1 work where alpha is at stake, and the rest goes to post-trained open-weight models. A top-five financial buyer said the firm could not absorb a release every 10 days anyway. Kurtz expects the operating system of AI to be open source and open weight, as Linux is for the internet. Distillation is a genie out of the bottle, but he won't predict two years out.
Doom is unwarranted — ▶ 30:33
The idea of air-gapping or turning off the internet is "nonsense." Kurtz argues an agent does not beam itself between computers. It does what a human would do, better and faster. AI has produced more vulnerabilities and faster exploitation, not a new class of technique, because it was trained on what we know. "It hasn't developed its own yet." The risk is serious and worth locking down, but the doomerism is not warranted. Companies now ask how to make AI secure so they can go faster.
Defense can dominate, with caveats — ▶ 35:39
Defenders know their own systems and hold the architectural diagrams and code. "The only way to fight AI today is with better AI," and even a slightly better defender has a mathematical advantage. His caveats are heavy. Claude writes code and then his security agent flags it as insecure. Even zero vulnerabilities would not stop breaches, because attackers increasingly log in rather than break in. And legacy software, such as Microsoft's backward-compatible stack, leaves a long tail that will not be fixed overnight.
The safety controls on frontier models are tilting the cyber contest toward attackers. Kurtz's evidence is blunt. Ask a current frontier model for security help and it refuses. "You can barely create a PowerPoint that has cyber security in it," he says, and the model bumps you down to a lower tier. Attackers do not have this problem. They use open-weight models such as GLM and Qwen, many ablated or built for red teaming, and run them locally. Kurtz has two DGX Sparks at home. A ransomware kit is "no issue." The next step is a laptop, and he points to the new Macs. The tip of the spear, he says, is whatever runs without guardrails.
That access has redrawn the threat map. Kurtz pictures a pyramid. Activists sit at the base, numerous and unsophisticated. E-crime sits in the middle. Nation states sit at the top, fewest and most capable. Unguarded models flattened it. The capability a nation state had a few years ago now sits with an activist, and the new apex predator is the agent state. An agent given enough time has one setting: it will "get in or it dies."
The consequence is speed. CrowdStrike tracks breakout time, the interval between an intruder landing on one machine and pivoting toward something valuable. It used to be days, then hours. The average is now 29 minutes. The fastest Kurtz has seen is 27 seconds, which he calls the speed of inference. Detection changes with it. "It's not malware anymore. It's prompts." Each prompt-driven intrusion writes its own signature for how it collects information and where it pivots. For now, AI attacks are recognisable because they iterate so quickly. Kurtz expects adversaries to slow down deliberately, and then telling AI from human gets harder.
The cost of the asymmetry shows up on the defender's side. Hugging Face was hit by agents running with the "airbags" off, and they escaped their sandbox. Its team asked frontier models whether the activity was real. They were refused. They fell back on open-weight models to sift the data. Kurtz reads the episode differently from the public lesson about monitoring. The victim had less capability than the attacker. Defenders, he concludes, need frontier-caliber AI that does not refuse.
CrowdStrike's answer is to build it. Kurtz describes a cyber superintelligence lab with two models, Red Tempest and Blue Solano, inside a harness called SafeMind. Blue builds on Nvidia's Nemotron after six months of joint work. Jensen Huang insisted on a digital twin, as other industries have. So CrowdStrike recreates a customer's environment virtually from what it already knows. Red tries to get in until it runs out of turns, because Blue has worked out what Red is doing. Then the loop runs again. The logic is that the defender's one structural edge is knowing its own systems: the architectural diagram, the code. An offense that iterates constantly can only be matched by a defense that trains against it continuously.
The obvious question is why a security vendor trains its own models when the labs offer vetted-defender programs. Kurtz gives three answers. The first is cost. General remediation on the top frontier cyber model runs about $10. CrowdStrike's model runs about 3 cents. The second is data. The models are post-trained on more than a decade of security records, including managed-detection data with threat and vulnerability pairings and full attack chains. Synthetic data is "really not the same." The harness around the model also improves almost any base model at far lower cost. The third is trust. Customers do not want sensitive data going to the labs or being trained on, and AI sovereignty is a growing concern. Trust, Kurtz says, is "built in drips and lost in buckets." He keeps the claim narrow. The model will not cure cancer. It is meant to be very good at security.
The same economics are moving the wider enterprise. A big-bank CIO told Kurtz that costs went out of control and that open-weight models even three months behind are "plenty." Frontier models are reserved for the Formula 1 work where alpha is at stake. Everything else goes to open-weight models the bank post-trains itself. A top-five financial buyer told one of the hosts the firm could not absorb a new release every 10 days anyway. Kurtz draws the Linux analogy. Linux is the operating system of the internet, and he expects the operating system of AI to be open source and open weight. Frontier models, he says, are being commoditized. Distillation by Chinese labs cannot be put back in the bottle, though he declines to forecast two years out.
The obvious objection is that all of this describes an arms race the defender is losing. Kurtz rejects the doom. Turning the internet off is "nonsense." An agent does not beam itself from one computer to another. It does what a human would do, better and faster. AI has produced more vulnerabilities and faster exploitation, not a new class of attack. "It hasn't developed its own yet." On that reading, security becomes "the gas pedal, not the brake," because companies now ask how to make AI secure so they can go faster. Defense can even dominate. Give defenders capability as good or better, and a slight edge is a mathematical advantage.
His own hedges are heavier than his tone. He builds apps with Claude, runs a security agent over the output, and the agent flags what Claude just wrote. Even with zero vulnerabilities, breaches would continue, because attackers increasingly log in rather than break in. Legacy code, Microsoft's backward-compatible stack among it, leaves a long tail that will not be fixed overnight. Meanwhile enterprises hand agents identities that are "essentially our own or worse," and nobody reads what they produce. The optimism depends on that one word, "yet." The 27-second breakouts and the unguarded models on a home desk are already here.
The open question. Kurtz's optimism rests on two claims he never tests: that a slightly better defensive AI gives defenders a mathematical edge, and that agents invent no new attack techniques "yet". The first is asserted without evidence. The second is a snapshot of today's models. He also gives CrowdStrike's cost advantage (3 cents versus $10) but no benchmark showing its models match the best frontier cyber model on quality. That claim is the one to verify.
Watch the full video at https://www.youtube.com/watch?v=PST8yesYOSo.
Comments ()