Michael Lubas on AI, Attack, and Defense

Michael Lubas, CEO of Paraxial.io and my first-ever guest, returns to talk about AI's dual role in cybersecurity: finding vulnerabilities and writing the code that creates them. We open with the Hex package manager penetration test Paraxial ran under the Erlang Ecosystem Foundation's Aegis initiative, funded through Alpha Omega. Michael caught a remote code execution bug before it shipped. From there we cover GitHub Actions supply chain attacks, why every maintainer should run zizmor, and campaigns that target release pipelines instead of application source. Then the AI inflection point. The EEF's CNA issued nine CVEs in all of 2025 and is on track for well over a hundred in 2026, driven by researchers like Peter Ullrich using AI to find bugs already sitting in source code. Firefox went from about 20 valid bug reports a month to over 400 in April 2026. Michael argues defenders without state-of-the-art models are at a structural disadvantage, and we get into why bug bounty programs are collapsing under AI-generated noise, something I saw firsthand with Killswitch. We close with the practical side: what a real pentest costs, when Claude Code helps solo developers, and the common Elixir gotchas, including binary term deserialization, SSRF, dynamic atom creation, and staying inside Ecto's default query syntax. Plus Paraxial vs. Sobelow and what SOC 2 actually covers. Resources Mentioned: - Securing Hex (Paraxial blog): https://paraxial.io/blog/hex-pentest?utm_source=elixir-mentor - Hex security audit report: https://hex.pm/reports/2026/paraxial.pdf?utm_source=elixir-mentor - EEF CNA: https://cna.erlef.org/?utm_source=elixir-mentor - Hardening Firefox with Claude: https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/?utm_source=elixir-mentor - What the CVE? (Peter Ullrich): https://peterullrich.com/what-the-cve?utm_source=elixir-mentor Connect with Michael: - Website: https://paraxial.io/?utm_source=elixir-mentor - X/Twitter: https://x.com/paraxialio Sponsors: - BEAMOps: https://beamops.co.uk/?utm_source=elixir-mentor - Paraxial.io: https://paraxial.io/?utm_source=elixir-mentor - Jido, Elixir AI Collective Discord: https://agentjido.xyz/discord?utm_source=elixir-mentor Support Elixir Mentor: https://elixirmentor.com/?utm_source=elixir-mentor