Where this was said
The Real AI Security Threat: Volume, Not Escape
At 19:38 · chapter starts 18:04
Bloomberg's top story about AI going wild serves as the episode's final provocation. De la Garza pushes Escobar on why he seems so calm, and the answer is characteristically pragmatic: a gap is a gap. If an AI finds it first, fine. If a human attacker does, that's also fine — in the sense that the gap was always there [1] — Emilio Escobar "The AI-hacking threat is real but overblown. If an AI doesn't find your vulnerability, a human attacker will. Emilio Escobar's real worry i…" 18:04 . The panic around AI hacking, Escobar argues, actually serves a useful function: it forces conversations that weren't happening before. His genuine concern is more structural. The vulnerability remediation industry runs on the assumption that you can and should fix every CVE. AI-assisted discovery is about to invalidate that assumption entirely by generating orders of magnitude more findings. He's also worried about a secondary effect: the 'Greek god problem,' where vulnerabilities discovered by AI models are automatically treated as critical and definitive, inflating third-party risk management processes even further.
The AI-hacking threat is real but overblown. If an AI doesn't find your vulnerability, a human attacker will. Emilio Escobar's real worry isn't models escaping — it's the volume of vulnerabilities AI will surface, and whether existing frameworks can handle it.
Emilio Escobar worries that AI will uncover 1,000 times more CVEs than current processes, rendering existing 'fix everything' mandates unworkable.
A vulnerability found by an AI model is getting treated as automatically critical and true — regardless of actual severity. Emilio calls this the 'Greek god problem,' and says it's about to make third-party risk management far worse.
