Wiz CTO Ami Luttwak：AI 能在 20 分钟内完成过去数周的攻击
Wiz 的 CTO 在 a16z 播客里讲得很实在：现在 AI 攻击只要 20 分钟，PHP 那个漏洞波及七成互联网。他讲了怎么用 agent 集群天天攻击自己的系统来找漏洞，创业公司该把这套流程直接写进开发环节。做安全的、写后端的都该听听。
Wiz 联合创始人兼 CTO Ami Luttwak 在 a16z 播客中表示，如今 AI 已能在 20 分钟内完成过去熟练攻击者需要数周甚至数月才能实施的攻击，他称之为"Black October"带来的变化。节目中他剖析了 PHP 漏洞事件——该漏洞影响约 70% 的互联网——并解释了为什么传统补丁节奏跟不上 AI 驱动的攻击速度。
在技术层面，Luttwak 介绍了 Wiz 如何用 AI 自己挖掘漏洞，并提倡"red agent"打法：用 agent 集群（agent swarms）持续攻击企业自己的系统，把自动化测试和打补丁嵌入开发流程，而不是等攻击发生后再响应。他认为安全预算应更多投向更好的安全架构，而非单纯囤积更多安全工具。
这期节目还讨论了持续安全测试的成本，以及"安全团队大部分工作其实不是安全"的组织问题。对开发者和创始人而言，核心结论是：在产品上线前就要用最新 AI 模型自我攻击，否则补丁速度永远追不上攻击速度。
Wiz co-founder and CTO Ami Luttwak says AI can now carry out cyberattacks in 20 minutes that once took skilled attackers weeks or months. In his view, companies need to continuously attack their own systems with the latest AI models to stay secure. For startups, that means building automated testing and patching into the development process from the beginning. Ami joins a16z's Sarah Wang and Zane Lackey to discuss what changed during Black October, why patching is falling behind, the cost of continuous security testing, and why better security architecture matters more than simply buying more tools. 0:00 Intro 1:04 Welcome to Black October 3:19 How AI made every day a zero day 6:51 The PHP vulnerability: 70% of the internet 9:19 Why patching can't keep up 11:32 How Wiz uses AI to find vulnerabilities 16:59 The cost of continuous testing 19:23 Cloud security in the AI era 22:18 The red agent: attack yourself first 26:41 Agent swarms attacking your own systems 28:43 What founders must do before they ship 32:15 Where security budgets should go 36:10 Most of what security teams do isn't security 43:34 Scan for Good and public infrastructure YouTube: youtu.be/PbD9pVXxsYM @amiluttwak @sarahdingwang @zanelackey
This report is categorized under AITOP's "Industry" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include Wiz, a16z, AI safety, agents.
Source attribution: curated from a16z (@a16z).
