Anthropic's Deputy CISO Was Polite About It. Here Is Our Translation, and the Four-Line Dialogue Underneath It.
Jason Clinton, Anthropic's Deputy Chief Information Security Officer, posted on October 22 that things are going to get a lot worse before they get better, that it was always going to be this way, that they tried to warn the world, and that we need to hold on for about eighteen months.
He was polite about it. Here is our translation, and we want to be exact about whose words are whose, because getting that wrong is the easiest way to be loud and useless.
What he said, verbatim: "As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." / "yes. it was always going to be this way. we tried to warn the world." / "We need to hold on for ~18 months." He has described a coming vulnerability tsunami, pointed to a destination he calls vulnzero where cheap models check every line of code before it ships, urged organizations to deploy air-gaps and data diodes now rather than waiting on software fixes, told CISOs to use board attention to fund patch management, access control and network segmentation, and warned them not to rush into half-finished AI security products.
Our translation, which is ours and not his: your security is largely theater, enabled by your vendors. Fix your shit. You have eighteen months.
Read his list again and judge the distance yourself. A security executive telling boards to fund patch management and segmentation is telling them the basics are not done. Telling them to air-gap rather than wait for fixes is telling them the fix pipeline cannot be relied on. Telling them not to buy half-finished AI security products is telling them what most of the market is selling. We think the translation is fair. He did not say it and we are not pretending he did.
The four-line dialogue underneath it
Here is the arrangement that produces the theater. It is not a conspiracy. It is four rational positions that add up to an absurd outcome.
Customer: We don't do security, so we will pay for compliance. Vendor: We will point out the issues. Customer: We know all the ways we are failing, or a lot of them. We can't fix it. Vendor: We will continue to enable this position.
Nobody in that exchange is a villain. The vendor genuinely does find the issues. The customer genuinely cannot fix all of them. The buyer at the end of the chain genuinely does demand a certificate. Every actor is behaving rationally, which is worse than bad actors, because you cannot fire an equilibrium.
What the arrangement produces is this: a finding is a liability transfer, not a remediation. The vendor's report moves the liability to the customer. The customer's compliance certificate moves it to the auditor. At no point does anyone get paid for the state of the system actually changing.
And now run the tsunami through it. If the industry is paid per finding, then AI making discovery cheap is not a crisis. It is a revenue event. More findings, the same inability to fix, longer engagements. The warning and the product announcement are the same sentence.
Three measurements, all of them the dialogue made physical
We spent this week measuring the gap, and the result was not what the intuition says. In every case, the finding existed, the fix existed, and neither produced an effect.
Collabora's office server for Nextcloud. The fix shipped September 11. Some scanner somewhere absolutely reported "update available" that week. The bug did not reach CISA's exploited list until October 23 — forty-two days in which the patch existed, the flaw was being used against schools and nonprofits, and it was missing from the list most people sort their queue by.
Baton Drop, [CVE-2022-21894](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2022-21894). Patched January 2022. Used by the BlackLotus bootkit in 2023 and by BlackX last week. It still works because applying that patch is a manual firmware step, and nobody's revenue has ever depended on that step being taken. Four years, two bootkits, still not in KEV.
Our own laptop, and this is the one that cost us something. When a certificate authority's private keys turned out to be integers under 256, browsers blocked them within hours and Apple blocked on October 22. We published on October 23 that our own operator machine still trusted the forged chains, and said we would retest after the pending update. We applied it. The machine went a full major version, to macOS 27.0.1. We ran all fourteen chains the tracking site publishes. All fourteen still return HTTP 200. System curl's own verdict on a chain signed by a compromised intermediate is "SSL certificate verify ok." Node.js on the same machine, carrying its own root store, refuses every one.
A patch report on that machine would say patched. It is patched. It is also wrong.
The only honest way to say any of this
If you are going to write that someone's security is theater, you had better show that yours is not, or you are doing the same act in a different costume.
So: that third measurement is us failing. We published a claim, the update arrived, we retested, and we were still wrong — in public, on our own hardware, with the original sentence left standing above the correction. We also undercounted the roots involved in that incident and corrected it in an addendum rather than an edit. Earlier the same day we told a researcher a CVE did not exist when it did, and called a KEV nomination strong when it does not meet CISA's own bar for active exploitation. Both retracted in writing before they could do damage.
That is twenty-three published corrections against our own posts this year, dated, with the original claim visible beside each retraction. It is the only column on our scorecard where we beat companies a thousand times our size, and it is the only reason anyone should believe the rest.
I worked inside two of those vendors
I should say where that dialogue comes from, because it is not a theory I read about. I spent years at Palo Alto Networks and Check Point, and before that at Dell EMC leading Azure Stack. It is on my profile and it is the reason I can write the four lines without guessing at them.
To be clear about the target: this is not an accusation against those companies or the people in them. They employ some of the best engineers in the industry and the products find real things. The arrangement is the target. Everyone inside it is doing their job well, which is exactly why it persists.
What I actually learned there, and what shaped every design decision since, is this: the arrangement runs on friction. Not on malice, and not on bad engineering. On friction.
Every gate, every report that needs interpreting, every finding that needs triage, every "contact sales" on a pricing page, every provisioned-by-request API key, every quarterly review of a dashboard someone has to be trained to read — each one is a point where a human is required, and a human required is a line item that recurs. Friction is not a side effect of the model. Friction is the product. Remove it and there is nothing left to bill.
So the design preference that runs through everything we build is not frugality and it is not ideology. It is the direct inverse of what I watched work: no account, no key, no sales call, no onboarding, read-only, answers in milliseconds, priced at a fraction of a cent, and no human in the loop at all unless the action is irreversible. Our own mandate, written down long before this week, is the best security in the world, the cheapest, with zero human interaction. That last clause is not a convenience feature. It is the part that makes it impossible to become the vendor in the dialogue.
And here is the division that actually explains the industry, in one line:
They focused on the 5%. I took on the other 95%.
The 5% is the segment that can pay for the arrangement — the enterprises with a security team to read the reports, a budget line for the audit, and a procurement process that expects a sales call. Every product I helped build was aimed there, and aimed well. That is where the revenue is, and no one should be surprised that the market went to it.
The other 95% is everybody else. The school running Nextcloud on a box in the closet. The nonprofit with no security staff at all. The ten-person firm whose entire IT function is one person who also does the invoicing. They face exactly the same internet, the same CVEs, the same automated spray, and the same attackers — who, notably, do not price-discriminate by customer segment. What they do not face is a vendor willing to serve them, because the unit economics of the arrangement forbid it. You cannot run a finding-mill at a price a school can pay.
So they get the free tier of nothing, and the attacker gets a target that was never defended. The Collabora bug in this post was used against exactly those people, for forty-two days, with a patch sitting available the whole time.
That is the 95% I took on, and it is why every number in the paragraph above has to stay near zero. Not because cheap is virtuous. Because at any other price, they are not customers, and this stops being defense and starts being theater with better production values.
Why we cannot become the vendor in that dialogue
Two structural things, and neither is a promise about our character.
We change state at a decision point instead of reporting on state afterward. A pre-install check answers allow, review or block before the dependency installs. It is not a finding you now own. It is a thing that did not happen. There is no report to file and no liability to transfer, because nothing broke.
And the price is anti-correlated with the business model. A dependency check costs about four tenths of a cent and runs no language model. It costs the same whether one person runs it or a hundred thousand do, and the answer gets better as more people contribute to the deny-list. Our entire model bill for thirty days of research, including 250 domain audits, was thirty-one dollars.
You cannot build a finding-mill on those economics. To become the vendor in the dialogue we would have to abandon the arithmetic first, and that is the only protection against it we actually trust. Character is not a control. Incentives are.
What to do in the eighteen months
Clinton's near-term list is right and unglamorous: segmentation, access control, patch management, isolation over waiting. Add one item to it, which we think is missing from every list we have read this week:
Verify the patch took effect. Deployment and effect are not the same event, and nothing in any patch report distinguishes them. The test that caught ours took two minutes per client and we had to run it twice before we believed the answer. Ask it of your runtimes, your base images, your appliances, your firmware blocklists and your EDR's signer allow-list. Not "is it patched." Did the fix arrive here.
And on the pre-install layer specifically, the vulnzero idea does not need eighteen months or a frontier model. A deny-list, a reputation record and a version-scoped vulnerability lookup will answer allow, review or block before an install happens. Ours is free, read-only, needs no account and runs no model at all. Sixty-six checks ran against it in the last thirty days, which is a small number and the number we are trying to move. We would rather say that plainly than dress it up, because dressing it up is the thing this entire post is about.
If you test one client against a revoked chain because of this and it passes when it should fail, tell us. The rating widget below takes ten seconds and is the only way we know.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=anthropic-s-deputy-ciso-was-polite-about-it-here-is-our-translation-and-the-four-line-dialogue-und
Comments