Michael Lubas on AI, Attack, and Defense

About this episode

Michael Lubas discusses the dual role of AI in cybersecurity, focusing on vulnerabilities and recent trends in the field.

Michael Lubas, CEO of Paraxial.io, returns to the Elixir Mentor Podcast to talk about AI's dual role in cybersecurity: finding the vulnerabilities and writing the code that creates them. Michael was my first-ever guest, and a lot has changed since his last appearance — most of it driven by the inflection point of the past six months. We open with the Hex package manager penetration test that Paraxial conducted as part of the Aegis initiative under the Erlang Ecosystem Foundation, funded through Alpha Omega and its donors. Michael caught a remote code execution vulnerability before it shipped, and the public report gives Elixir a strong story to tell about the security of its package ecosystem. From there we get into GitHub Actions supply chain attacks, why zizmor is the tool every maintainer should be running, and the recent campaigns where malicious code targets release pipelines rather than application source. The conversation turns to the AI inflection point. The Erlang Ecosystem Foundation's CNA issued nine CVEs in all of 2025 and is on track for well over a hundred in 2026, driven by researchers like Peter Ullrich using AI to find vulnerabilities that already existed in…

People in this episode

Host: Jacob Luetzow

Guest: Michael Lubas

Topics covered

• AI in cybersecurity
• vulnerabilities
• code execution
• supply chain attacks
• Erlang ecosystem security
• CVE reporting
• AI impact on security

Keywords

• cybersecurity
• AI vulnerabilities
• remote code execution
• supply chain attacks
• CVE
• Erlang
• Hex package manager
• GitHub Actions
• malicious code

Mentioned in this episode

Organizations: Paraxial.io, Erlang Ecosystem Foundation, Alpha Omega, Firefox

Products: zizmor

More episodes of Elixir Mentor

• Tjaco Oostdijk on Drums to Elixir · June 7, 2026 · 1h 31m
• Peter Ullrich on Hunting CVEs · May 30, 2026 · 1h 50m
• Jason Allum on Bedrock · May 24, 2026 · 1h 35m
• Vasilis Spilka on LLMs & Ash · April 21, 2026 · 1h 37m
• Luca Corti on Bringing Elixir to Fintech · April 12, 2026 · 1h 40m
• Steve Domino on Starting a Fintech · April 4, 2026 · 1h 35m