Ami Luttwak

About Ami Luttwak

Ami Luttwak is co-founder and CTO of Wiz, the cloud security company that is now part of Google. In an a16z conversation with Zane Lackey and Sarah Wang, he describes what Wiz calls Black October: a month of vulnerabilities and AI-driven attacks, including the PHP2Shell vulnerability in PHP, that he sees as the point where predicted AI attacks became real.

Notable Positions

On the Speed of AI Attackers

Luttwak says an attack that took the best human attackers weeks or months now runs in around 20 minutes, and that open-source models are no more than about three months behind frontier models at finding vulnerabilities. Startups that hold customers' AI keys are a prime target.

On Multi-Model Pipelines

Wiz's blue agent investigates attacks through a pipeline: a deterministic detection, then a cheap model, then a more advanced one, with the most expensive model deciding only when the others agree. Luttwak calls building such pipelines the new engineering challenge for anyone running AI at scale. See Model Routing.

On Exposure Before Code Scanning

He argues that scanning an entire code base with a frontier model is an expensive one-off. The budget should go first to unauthenticated, internet-facing surfaces, scanned continuously, and then to deeper attacks on critical applications.

On What Security Teams Do

Luttwak says most security team time goes to compliance and reports instead of finding critical risk, mitigating it and preparing to respond. He puts secure design, such as isolation and lockdown, ahead of bigger budgets.

Key Quotes

• "You cannot throw money on code scanning and think you're done." (on continuous scanning)
• "Most of what security teams do is not security." (on where teams spend time)
• "I cannot run the most advanced, expensive model on every event." (on the blue agent pipeline)

Related Reading

• Model Routing - Sending each task to the cheapest model that can do it
• Agent Harness - The infrastructure around the model