Subvolts take AI now finds security bugs in heavily audited code, potentially easing cybersecurity's talent shortage. Dec 10, 2025 - Developers
- Learn how AI agents can assist in finding and patching security vulnerabilities in your code.
- Business
- Understand how AI is enhancing software security and potentially mitigating risks from cyber threats.
This interview features a former OpenAI CISO leading an AI agent that finds critical security flaws, highlighting AI's growing role in cybersecurity.
The AI That Found A Bug In The World’s Most Audited Code
Audio streams from a16z. Your place is remembered on this device.
From Subvolts
Summary and analysis by Subvolts editorial, AI-assisted.
This AI + a16z podcast episode features Matt Knight, OpenAI's former CISO, discussing Aardvark, an AI agent he leads. Aardvark finds security vulnerabilities by reading code and writing tests, recently discovering a bug in OpenSSH. The conversation traces AI's evolution in security analysis and touches on the XZ Utils backdoor and the potential relief for cybersecurity jobs.
An AI agent called Aardvark is finding hidden security flaws in software, like a digital detective. This is important because it can help protect computers and online systems from hackers, especially with so many security jobs unfilled.
This episode offers insight into how AI is actively finding security flaws in critical software, a task previously requiring human expertise. It's for anyone interested in AI's practical applications in cybersecurity, from developers to security professionals and business leaders concerned with software integrity. The discussion connects directly to current frontier lab efforts in building more capable AI agents for complex problem-solving and securing digital infrastructure.
- Hosta16z
- GuestMatt KnightLeader of Aardvark, OpenAI
- Guest: Matt Knight, former OpenAI CISO and leader of Aardvark
- Show: AI + a16z
- Length: 39 minutes
- Concrete Claim: Aardvark found a memory corruption bug in OpenSSH.
- Concrete Claim: AI models evolved from analyzing security logs to discovering missed bugs.
- Statistic: 3.5 million unfilled security jobs
Matt Knight spent five years as OpenAI’s CISO. Now he runs what colleagues call “the most interesting job at the company”: leading Aardvark, an AI agent that finds security vulnerabilities the way a human researcher would—by reading code, writing tests, and proposing patches. It recently found a memory corruption bug in OpenSSH, one of the most heavily audited codebases in existence.
In this conversation with a16z’s Joel de la Garza, Matt traces the evolution from GPT-3 (which couldn’t analyze security logs at all) to GPT-4 (which could parse Russian cybercriminal chat logs written in slang) to today’s models that discover bugs humans have missed for decades. They also discussed the XZ Utils backdoor that nearly compromised half the internet and why 3.5 million unfilled security jobs might finally get some relief, and how Aardvark could give open source maintainers a fighting chance against nation-state attackers.
If you enjoyed this episode, please be sure to like, subscribe, and share with your friends.
Follow Matt Knight on X: https://x.com/embeddedsec
Follow Joel de la Garza on LinkedIn: https://www.linkedin.com/in/3448827723723234/
Check out everything a16z is doing with artificial intelligence here, including articles, projects, and more podcasts.
Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.
- CISO
- Matt Knight
- Chief Information Security Officer, a top security executive.
- memory corruption bug
- Matt Knight
- A software error where data is written to the wrong memory location, potentially causing crashes or security risks.
- OpenSSH
- Matt Knight
- A widely used program for secure remote logins and file transfers over networks.
- XZ Utils backdoor
- Matt Knight
- A hidden vulnerability intentionally placed in a common software tool that could have compromised many systems.
24 minHow AI Is Rewriting the Rules of Cybersecurity | Truffle Security & Socket
WithDylan Ayrey, Feross Aboukhadijeh
47 minInside vLLM: The Engine Powering Open-Source AI
WithSimon Mo
41 minBuilding Self-Accelerating AI with Mirendil
WithBehnam Neyshabur, Harsh Mehta
43 minIdeogram’s Open-Weights Image Model and the Future of AI Design
WithMohammad Norouzi
1 h 01Why Physical AI Needed a Completely New Data Stack
WithNikolaus West
48 min
1 h 05Stack Overflow users don't trust AI. They're using it anyway
WithPrashanth Chandrasekar
Questions people ask
- What is Aardvark?
- Aardvark is an AI agent developed at OpenAI that finds security vulnerabilities by reading code and writing tests, similar to a human researcher.
- What kind of security issues can Aardvark find?
- It can find complex bugs, like memory corruption, even in heavily audited codebases such as OpenSSH, and has evolved from analyzing security logs to discovering human-missed vulnerabilities.
Page generated Oct 19, 2026. Summaries are Subvolts' own; the audio, artwork and notes belong to a16z.