What did Nikesh Arora say about Mythos and AI models finding software vulnerabilities?

Nikesh Arora said models trained on huge amounts of coding data learn what bad code looks like, so tools such as Mythos can find vulnerabilities. That helps attackers more than defenders, because an attacker needs one flaw while a defender must patch every flaw. He estimated that 60 to 80 percent of flagged vulnerabilities proved real, the rest hallucinations.

Arora proposed pooling vulnerabilities through trusted parties so patches reach every company at once.
Arvind Krishna said coding agents now write about half of IBM's code, but evals catch only the flaws people already know how to find.

▸In their words

“But the problem is, the reason it's perfect for attackers is they just need one vulnerability.” Nikesh Arora · at 17:07 — open in the transcript →

Source: our own transcription of the episode. The full conversation is on All-In with Chamath, Jason, Sacks & Friedberg (2026-10-21). Read the whole episode summary →

▸More from this episode

Q1When does Arvind Krishna say quantum computers will break today's encryption?Q2Can AI models break cryptography before quantum computers, according to Arvind Krishna?Q3Why does Arvind Krishna think most AI tokens will move to open-weight models?Q4When does Nikesh Arora think enterprises should use frontier AI models instead of small models?Q6What did Arvind Krishna say about AI regulation and state bans on data centers?Q7Why do Nikesh Arora and Arvind Krishna expect consolidation in SaaS and enterprise software?

Ask your own recordings. Upload a podcast, a lecture or a meeting and ask it questions like this one. Transcribe with Whipscribe →