Wiz 联合创始人 Ami Luttwak：AI 让网络攻击缩短到 20 分钟
Wiz 的 CTO 说现在 AI 攻击 20 分钟就能偷光你的密钥，建议给 AI key 设用量上限，还讲怎么用 agent 集群攻击自己的系统找漏洞。初创团队做安全规划前听听，比多买几款工具有用。
Wiz 联合创始人兼 CTO Ami Luttwak 在 a16z 播客中表示，过去需要熟练攻击者耗时数周甚至数月完成的网络攻击，如今借助 AI 只需约 20 分钟就能从入侵到窃取全部客户 AI 密钥。他接触的多家初创公司 CEO 都在夜间遭遇入侵，安全团队来不及拦截。
他给出的具体建议是：持有 AI 密钥的团队应立即为密钥设置用量上限，避免密钥被盗后产生高额账单——这种情况在客户中已经很常见。他认为公司需要用最新 AI 模型持续攻击自己的系统（红队 agent 集群），并把自动化测试和补丁流程从开发第一天就内置进去。
播客还讨论了“Black October”期间的行业变化、影响约 70% 互联网的 PHP 漏洞为何补不过来，以及安全预算应投向架构而非单纯采购更多工具。对初创公司而言，是否是大公司不重要，只要握有攻击者想要的资产就是目标。
Wiz co-founder and CTO Ami Luttwak says cyberattacks on startups can happen faster than ever: "I work with the CEOs of startups that are getting attacked. Let's just be in their shoes. You wake up, and your security team says, 'Something bad happened overnight. We tried to stop it, but they got in.'" "The entire attack, again, takes 20 minutes... from the time they get in until they take all of the secrets, all of the AI keys of all of the customers. And now you have to figure out what are you going to say to all of the customers, and what you're going to do." "But if I'm a startup, especially if I have anything attackers want... I am on their target. It doesn't have to be a big company." "If you have AI keys, probably better to put a limit on them, because if they steal them, you don't wanna get a lot of charges, which we see happen a lot, and it's really, really sad. But also make sure that if you have a target on your back, you do need to put a lot of focus on security." @amiluttwak
This report is categorized under AITOP's "Industry" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include Wiz, a16z, AI safety, cloud security.
Source attribution: curated from a16z (@a16z).
