Arvind Narayanan

Such a great post! Insights I particularly appreciated: - "Why hasn’t a huge discontinuity in damages happened since the dawn of scaled AI? This non-responsiveness of damages to a rising tide of AI capabilities is the major conceptual crux, and stumbling block, of all AI security policy today." - "cybercriminals are unskilled and get arrested a lot ... Criminal organizations need to base themselves in middle and lower income countries, where they can pay less and hire people who have few formal-economy options. ... I think folks in the AI safety and cyber world sometimes imagine adversaries as their Waluigi twins, implicit MIT graduates; in fact, in cybercrime we’re dealing with a lower-skill demographic." - "Criminals also contend with the risk and reality of arrest, sanction, interdiction, and prosecution, which caps their ability to scale: the larger the organization, the more domestic and international law enforcement attention it attracts." - "It took the attacker ecosystem a very long time to mature the workflows, business models, and industrial divisions of labor that scaled ransomware into a multi-billion dollar industry, and it’ll take a long time to develop new models that centrally leverage AI throughout criminal labor processes... it took 5-8 years for ransomware to become a huge deal" - "As risk professionals we should assume this will all change and that what we have now is a defender-dominant window in which we can prepare for some very bad possible futures" Lots of interesting charts too: https://joshuasaxe181906.substack.com/p/if-the-vulnpocalypse-is-the-apocalypse