Michael Lubas on AI, Attack, and Defense
About this episode
Michael Lubas discusses the dual role of AI in cybersecurity, focusing on vulnerabilities and recent trends in the field.
Michael Lubas, CEO of Paraxial.io, returns to the Elixir Mentor Podcast to talk about AI's dual role in cybersecurity: finding the vulnerabilities and writing the code that creates them. Michael was my first-ever guest, and a lot has changed since his last appearance — most of it driven by the inflection point of the past six months. We open with the Hex package manager penetration test that Paraxial conducted as part of the Aegis initiative under the Erlang Ecosystem Foundation, funded through Alpha Omega and its donors. Michael caught a remote code execution vulnerability before it shipped, and the public report gives Elixir a strong story to tell about the security of its package ecosystem. From there we get into GitHub Actions supply chain attacks, why zizmor is the tool every maintainer should be running, and the recent campaigns where malicious code targets release pipelines rather than application source. The conversation turns to the AI inflection point. The Erlang Ecosystem Foundation's CNA issued nine CVEs in all of 2025 and is on track for well over a hundred in 2026, driven by researchers like Peter Ullrich using AI to find vulnerabilities that already existed in…
People in this episode
Host: Jacob Luetzow
Guest: Michael Lubas
Topics covered
- AI in cybersecurity
- vulnerabilities
- code execution
- supply chain attacks
- Erlang ecosystem security
- CVE reporting
- AI impact on security
Keywords
- cybersecurity
- AI vulnerabilities
- remote code execution
- supply chain attacks
- CVE
- Erlang
- Hex package manager
- GitHub Actions
- malicious code
Mentioned in this episode
Organizations: Paraxial.io, Erlang Ecosystem Foundation, Alpha Omega, Firefox
Products: zizmor
More episodes of Elixir Mentor
Explore listener stats, chart rankings, contacts and more on the Elixir Mentor podcast page.