Become a Creator today!Start creating today - Share your story with the world!
Start for free
00:00:00
00:00:01
Episode 36 - flacko
1 Plays3 seconds ago
riptide & flacko take a tour inside Grego AI’s lab including the origin story, why riptide co-founded the company, the AI security narrative, the future of bug hunting with AI, how their depth-first tool stacks up against the rest of the AI-sec space, flacko's humble beginnings and his journey with Grego AI, random discussion about motorcycles, and much, much more …
Recommended![Episode 19 - 0xe4669da [SPECIAL n00b EDITION] image](https://media.zencastr.com/cdn-cgi/image/width=112,quality=85/image-files/677fcded3f04b4e1c3f96cfc/1b4f61b7-5c8c-48b2-9d61-66ec9549c632.png)
Transcript
Podcast Comeback and Introduction
00:00:00
Speaker
Bounty Hunters. Life on the blockchain.
00:00:08
Speaker
Oh, look who's back. After a hiatus, the Bounty Hunters podcast is back with a vengeance. Welcome back to Bounty Hunters. I've been extremely busy with working on building Grego AI to find bugs using AI, elite AI methods.
00:00:29
Speaker
But I figure we have to keep the podcast going because it's awesome.
Guest Mr. Flacco's Journey into AI and Security
00:00:33
Speaker
So... decided to bring on one of the biggest brains in this space.
00:00:41
Speaker
A brain so big, it only fits in Bulgaria. So welcome, welcome Mr. Flacco to the podcast.
00:00:53
Speaker
Welcome, welcome. How am I supposed to stay serious after such an introduction? don't even know what that intro is, man, but it's a good one. I appreciate it. I appreciate it.
00:01:07
Speaker
It's just been so busy, man. I mean, like... I recall my old life of sitting in front of the screen seven days a week, just freestyle hunting bugs.
00:01:18
Speaker
And i I look back with rose colored glasses, how good it was. And ah those were the days that now I'm running this company, traveling around everywhere. And it's a different story now.
00:01:30
Speaker
It is, yeah. Like watching it from from the site, like I can confirm it he has nothing in common. ah ah So just for the listeners out there, so Flacco works here with us at Grego AI, where he is the head of bugs, ah where he he does all all matter of things related to bugs. And he's a...
00:01:54
Speaker
He's a very great guy to work
Old vs New Learning Methods in Programming
00:01:56
Speaker
with. And so I thought I had him on the pod. He also has a an interesting security background. So let's let's kind of kick it off, man. Give give me give us some background here. what's What's going on with you? Who are you? Who's this Flacco with this Benjamin Franklin avatar?
00:02:13
Speaker
it's what Yeah, so I'm a combo security researcher with... modest like career in Web3.
00:02:25
Speaker
ah I start like my full background includes a few years as a web developer as most of the guidance face. And yeah, then I discovered Web3 security, started just looking around, know, and as a hobby mostly.
00:02:46
Speaker
My interest picked up and at some point I had to, yeah, um make a choice. So I went to Oland like two years ago, perhaps.
00:03:00
Speaker
And yeah, it's been a wild ride ever since. At first, I was Oland into Solidity like everybody else. And
00:03:13
Speaker
shortly after, i discovered Golang and Cosmos SDK. And I kind of went into DLT and just infra projects, like almost 100%, because it mostly, it has been more relevant to my past experience. So, yeah.
00:03:38
Speaker
I then went on to learn Rust and look into bunch of different projects. And yeah, this is... this This is a concise summary of my ride so far.
00:03:51
Speaker
and Doesn't it seem like another lifetime ago, like like what you're talking about with you were you're using Go, learning Rust, like learning a language, you had no AI assistance, right? does Is it just me or does it seem like it's a complete different universe?
00:04:12
Speaker
oh It definitely is a different thing, but I could argue that you can still go like old school. And I actually looked into C-Lang recently, and I decided to give it a go. I just found some book online, and I barely used AI to you know teach myself C-Lang.
00:04:40
Speaker
This could be me, I don't know. One of our researchers loves using AI to learn new things and generate documents for them. But yeah, I like to go old school and just read a book, you know play with play with the codes, have some hands-on experience. But yeah, nowadays with AI, you can definitely speed up the whole process.
00:05:09
Speaker
significance. You can have AI be your teacher, basically. Yeah. um I'm just thinking like learning programming languages because you you get to stopping points where you start saying, okay, well, like the book or the materials you're reading doesn't explain something that you're thinking about.
00:05:29
Speaker
And then you'd have to search in the internet or or just think about it for a long time and and try to get to that answer. Whereas as I guess you can speed that up with AI, obviously. But I don't know, am I just nostalgic for the, for like, like what you're doing nostalgic for the old learning methods where you just crack a book and just, just labor through it. And really is like, I haven't done an AB b test to see which way
Founding and Mission of Grego AI
00:05:56
Speaker
I'm retaining more information using AI to assist or just doing it the old school way.
00:06:02
Speaker
Uh, like.
00:06:06
Speaker
The immediate answer that comes to mind is that, you know, AI through like bugs and like bugs when you are, for example, trying to code up something,
00:06:20
Speaker
um makes your brain lazy because I remember having to, in my dead days, I had to Google stuff for four hours. So then just to get to a resolution and now you can just write a simple sentence in a prompt and you'll most probably have your problem solved like in a minute.
00:06:41
Speaker
So Yeah, I haven't... Like, I've coded a lot recently. Like, a lot. ah But I haven't done a code review on on a single line of code. So...
00:06:57
Speaker
Not really learning anything. Vibe coding, Vibe coding. You know, one of my things when I was first learning, actually any language, but when I was a teenager, I was teaching myself, I think it was C at the time, and then PHP more in depth after that.
00:07:16
Speaker
And I remember doing the same thing you were doing, like look for something. And then I'd i'd be searching online, like, oh, what is what is like a global variable? Like, why can't it do this? There's just some question. And I would i would sit and think like, I wonder what it's like to be like an expert programmer. Like there's no way they're on Stack Overflow.
00:07:36
Speaker
Like no hit expert programmer, someone that knows what he's doing is on this site, like me wasting hours trying to get to a solution. And now you could be that guy with AI. Like you you have that expert programmer next to you in in the passenger seat.
00:07:52
Speaker
And yeah, I mean, do you do you keep learning the same amount or do you just do that quick handoff and then not even not even worry about it? Just like a spell check.
00:08:08
Speaker
To be honest, with how things been going lately oh and how much stuff I'm trying to create oh in parenthesis Vibe code,
00:08:21
Speaker
oh there are a few skills that I use that basically help me narrow down the plan for what's to be no implemented.
00:08:34
Speaker
And I don't... i First of all, I never write a single line of code myself. ah And then, i as I told you earlier, I never do code review either.
00:08:45
Speaker
Because if I have to do it, i would probably have created one like 1% of what I've created over the past few months.
00:08:57
Speaker
Like it it would be way slower. And of course, it's important to mention these are, you know, internal tooling and projects that, need to work, you know, they they don't need to be perfect or like maintainable over the course of tens of years. ah We just need them now and we need them to work.
00:09:20
Speaker
So yeah, the, Yeah, this is not serious. Yeah, like, you know, internal tools are are so great with the vibe coding.
00:09:32
Speaker
um The things that deploy facing the Internet, facing customers. I mean, that's where you have more more issues. We don't have to worry about that. Like as a security company, it's like we're just doing internal tools. Who cares?
00:09:47
Speaker
All right, maybe we'll kind of break off a bit. So let's so everyone's been been hearing about you know where the where the fuck is this podcast? This guy never posts anymore. And I say I'm always busy with Grego AI, this company. So maybe I'll give some background here and we'll talk about like what you're doing at the company, what the hell we're doing there. and And maybe it'll be interesting to people. So let me just give the background on Grego AI and what happened.
00:10:16
Speaker
So like last year, last summer, i was i was happily looking for bugs. And this was GPT two or three was out, I think. It was still a slop factory.
00:10:30
Speaker
And i had multiple people approach me with different AI bug hunting tools. And really they were just, it was all slop. was all invalid findings and it was all noise. And I said, okay, it's like, I see the potential, but it's not there yet.
00:10:47
Speaker
And then I was introduced to my co-founder Greg through through Jeff at Rare Skills. And he said, hey, I met this young Argentine kid who developed this AI bug hunting tool.
00:11:04
Speaker
And I want you to check it out. think it'd be great. And i was skeptical. was like, okay, sure. let me I'll take a look. And so we connected and he started sending me some bugs.
00:11:17
Speaker
And I looked at the write-ups, the reports, and I was like, whoa, like these are these are impressive. And I was able to invalidate the initial ones, but not not due to slop. It was just due to them being invalid. Like,
00:11:35
Speaker
like using Fion transfer tokens or, you know, it was like a critical impact, but it was one way, stuff like that. So like they were legit findings, but it was just, you know, not legit if you know what I'm talking about. So ah this really, it was, it was intriguing. I said, okay, this guy's onto something.
00:11:57
Speaker
And so we start talking and I was in Italy at the time. So Greg just flies out on a whim, a 12 hour flight and lands on my doorstep. And we start we start a cooking in some apartment for a week and I was going to invest. And then the further I went down the rabbit hole, I said, hey, let's co-found this because I think um we can make a big impact on security.
00:12:26
Speaker
And so we both had the same thing in mind. And then we know we got together, we co-founded this and bootstrapped this up until around December, January. And then we were able to get some venture funding led by Cyberfund.
00:12:43
Speaker
And those are the guys who created Lido, if you if you know them, great team. So they led the round. And then from then, so in the past six, seven months now, ah we we started building the business and we ended up hiring some, like the the first six months of the business was like, let's no one knows what this company is. No one knows the technology that we have.
00:13:10
Speaker
How do we make it known? How do we stand out against all the known brands that are now creating their own AI bug hunting tools?
Evolving Strategy and Differentiation of Grego AI
00:13:18
Speaker
And how do we just, how do we get the message out? And I thought the best way to do this, because I had seen, and I'm not going to bad mouth anybody, but I had seen the usual suspects out there talking about finding vulnerabilities with their AI and they didn't post any receipts.
00:13:35
Speaker
And every security researcher knows, trust but verify, and we couldn't verify. so I didn't want to be that kind of firm with that kind of reputation. So I decided to only post findings that we could objectively verify. Anyone could look at it and read the whole report, see the GitHub commit, everything.
00:13:57
Speaker
And so that was what we did. We went after bounty programs. Also, we did that because a lot of benchmarks were out there and we believe those were flawed. ah They could be manipulated. So we decided to go after the hardest bugs, which are bug bounties, obviously.
00:14:14
Speaker
And so we were able to find over half a million in bug bounties over the course of six months. We found that that very large one saving 27.7 million, earning a quarter million on that one.
00:14:30
Speaker
And this was all from the AI. So we're able to do that we've posted write-ups on the X account. in depth. And so that was the that was the whole motivation. It's the first initial foray here was to just put out like, here's the brand, here's what we're doing, pay attention to us. And so far it's worked.
00:14:53
Speaker
And we've done some audits with the clients. and Now we're starting to expand. We've built out kind of a SaaS platform so you can go in there and and put your repo in. And then we work with you and and help you run the audit, kind of a hybrid model that we're doing.
00:15:09
Speaker
So that's kind of where we're at now. So that's that's pretty cool. And now we're raising a seed round to really like go to the next iteration of this company, which is building a whole security operating system that's like a proactive AI white hat defense system.
00:15:25
Speaker
So really cool things in the pipeline. um So that's the story of the company. So we, I think well the first the first guy we brought on was you, right? I think you were the first hire.
00:15:41
Speaker
ah Possible. i ah can't really remember because, i know you know, my memory is bad, but yeah. I think it was the three of us starting like all together.
00:15:54
Speaker
i think it was on 12th of January, but yeah, these are details. Yeah, because you were always in my mind because we met first time at ETH Sofia.
00:16:06
Speaker
That's right. Right. And I just remember like, ah you just seemed like a good guy. Like you seemed like a very smart guy and you had a cool demeanor.
00:16:17
Speaker
And I think you like to to drink a few beers. And I was like, oh, this guy is pretty cool. and and and And so I was thinking, I was like, we need a guy to help like triage these bugs and, you know, go through, like do all kinds of stuff because I'm trying to build the company and I need this head of bugs to kind of manage the whole process.
00:16:38
Speaker
And I was thinking, man, you know, who would be a great candidate? And then I thought of you and I was like, I got to call Flacco, man. I think this is January, right? January, February?
00:16:49
Speaker
ah Like the timeline is a bit different. Like, each of here was in September of 2025. And like, you you hit me up when we met at first and that at that dinner.
00:17:05
Speaker
and you were like, hey, can you triage like Golang Fines or something like that? i was like, yeah, sure. Then it's January and we start working together and you pay me a visit in my hometown in February and you hit me up with, hey, I can't take care of everything no more and at that pace while we are you know smoking cigars. That's right. Drinking fine whiskey. Absolutely.
00:17:41
Speaker
That's true. And then, Polish off the night with a nice kebab. I recall this. Yeah, this is good. This was the, the intro meeting. Yeah, that's right. So this was because, so we were doing these finds, doing these runs, bootstrapping it. and when I was getting findings that were in, we're starting to go like test other languages outside of solidity.
00:18:04
Speaker
And we started doing go and rust. And, you know, my experience there is very limited. So I was like, okay, how am I supposed to do this? And at that time, you couldn't really use AI to help you that much on like, you know, I mean, you still need to manually verify a finding because all bug hunters know this. Right.
00:18:25
Speaker
And so I needed an expert to do that. and that's I think that's what pointed me initially towards your your universe.
00:18:33
Speaker
Yeah, I at least can never trust AI in absolute 100% terms. there's there will There will, I feel like, always be that 1% or even 0.1% suspicion that it screwed up something.
00:18:54
Speaker
so So yeah, validating stuff, even though you can... you know, employ AI and make the process quicker and easier for you, you still need some knowledge, what you know, whatsoever to to put the stamp on it and be confident in your judgment.
00:19:17
Speaker
Yeah, I wonder when that disappears. i I mean, we're dealing with a ah probabilistic system that can generate two different outputs for the same input, multiple outputs.
00:19:29
Speaker
And yeah, you have that fear and and it's it's gotten better, obviously, with the application that you're that you're talking about. But when does it become like where you can just say, validate the bug and you don't have to handhold it?
00:19:49
Speaker
I mean, isn't this the question that everybody asks themselves? us
00:19:58
Speaker
I mean, I can speculate, but it's really hard to even anticipate, man. it's At some point, things are going at a very fast pace development-wise and how it's progressing. And then there is a period of three months when it feels like nothing's happening you know and it has stalled.
00:20:24
Speaker
Yeah, me, I'm not, to be to be frank, I'm not, like, too much into following the AI scene and, you know, how I'm not familiar with machine learning or how any know of that stuff are trained or, you know, developed at Entropic or OpenAI or any, you know, AI lab.
00:20:50
Speaker
So it's hard for me you not so to anticipate, but generally speaking, I think I would expect this to be achieved in no more than, don't know, five, ten years.
00:21:07
Speaker
I mean, it's it's it's a relatively... It's it's achievable. It should be achievable. That's a big timeline, five to 10 years.
00:21:18
Speaker
I'm trying to be optimistic. i But I go on crypto Twitter and it tells you five to 10 days. um Yeah, it's it's been telling five to 10 days for two years now.
00:21:31
Speaker
Yeah, who knows, man. All right, so we hired you on, um you became the king of bugs at Grego AI.
00:21:43
Speaker
And then we said, hey, look, we have there's just too many bugs to to look at here and go through. And then you know you you cleaned up the whole thing, like it was completely disorganized. You built these systems and and made this, like, you this has been an evolution, right? But you made it much more organized and we can actually wrap our head around what the hell we're doing here spending God knows how much on the early versions with the compute costs and eventually bring on who who do we bring on next?
00:22:17
Speaker
Was it? I think it was it was Babs. I think it was Babs and then it was Blade or Scion. So we have, if you guys know those names, we have Babs, we have the Blade and we have Scion. Maybe I'll get all these guys on here eventually.
00:22:37
Speaker
But each has each has their own kind of specialty, ah but I've... I think I'm a good judge of character. it seems like everyone is just really outperforming my expectations. Like I'm really impressed with some of the output I see from you guys. And it's just incredible. Like ah I look at that, you know, I'm doing my own thing. And then I look at what you guys are doing and,
00:23:02
Speaker
And it's kind of crazy. Maybe you could like give some background. like what's What's kind of the day-to-day? What have you been seeing yeah know in the past couple months? you Maybe you could like tell what we've been up to from your perspective.
00:23:18
Speaker
Yeah, so I'll start from January when you know I was just triaging books and I didn't have any...
00:23:30
Speaker
bird's eye view of ah like the big picture that's happening. And it was you know just the two of you with Greg and the three of us that were triaging books.
00:23:44
Speaker
But yeah, then in February, ah when you know I changed positions, And I saw what's up in the back office, to call it so. my My OCD was staying at max level for like three weeks with no break whatsoever. no There was some organizing to do, as you mentioned.
00:24:12
Speaker
But yeah, once that was out of the way... um ah kind of like I kind of started having, you know, mental space to to digest in everything that's happening.
00:24:29
Speaker
And I remember you ah just when we had, you know, calls, all of us, you would be like, hey, man, this thing has, you know,
00:24:42
Speaker
there is a lot of potential, you know, there there are a lot of good good things coming. And, you know, with some projects that I personally had three of, you know, we had more or less hiccups and not perhaps that many valid findings as I wish.
00:25:04
Speaker
ah And I was like, okay, like, I trust him, obviously, you know, I have no suspicions, but I'm not sure if I really understand the vision, but then when I started having a view of what everybody's working on, you know, how everybody's progressing, the different projects, the different findings, basically everything, i started chanting the very same thing that you did.
00:25:33
Speaker
And I then understood. And I was like, damn, this this thing really is like an untamed beast. And... it really does have a lot of potential. I mean, it's when you see everything that's happening in parallel,
00:25:52
Speaker
it really is a different point of view that gives you the whole perspective. But yeah. oh
00:26:01
Speaker
After... Yeah, and go ahead. No, i was just saying, like um like, when we talk about, like, what you were looking at, so like the first six months of we were talking about is looking for bugs and bounties.
00:26:14
Speaker
And you're going through all these findings. And it's like, and we're tuning the tool, right, based upon feedback from yourself and the other researchers. But in the end, like we're trying to go after the hardest set of bugs, right? So half the battle is not even scanning the contract, scanning the repo.
00:26:37
Speaker
but it's like any true bounty hunter knows like it's about where you look. So, okay, like yeah to be honest, like your chances are are quite mediocre. If you're just scanning a GitHub repo, like you need to use all your strategies and,
00:26:58
Speaker
like look at prior audit reports, see what's out of scope, check the on-chain state, look at dependencies, look at composability, governance forums. Like there's so many different vectors ah to look at. And we were just kind of like,
00:27:17
Speaker
just hardcore thrown in repos. I mean, this was like version one of the tool and just saying, hey, let's just use a lot of compute. Let's let's scan all these for bugs. And um I don't know what our hit rate was initially. Like for like we we obviously could have done it better on V1. Let's talk about but this. But this is like, let's just brute force this thing and and go hard on it. but But yeah, like thinking about it, if we had a fully designed product that could branch out and and be like a true bounty hunter, I mean, which I think some other guys are trying to build something like this. You'll see different variations of this, but some some of the king bounty hunters, I know they're using AI in their workflow to kind of automate some of these things.
00:28:07
Speaker
We already automated like the watching scripts back in the day, but now you can just upgrade all of that and and use AI to help you hunt, which is pretty cool. So we were just to put context around there. We were just kind of going hard raw dog in this thing and just, you know, iterating as we, as we advanced internally on this product.
00:28:32
Speaker
Yeah. I mean,
00:28:36
Speaker
I don't know anybody who has managed to one-shot it you know from the first try. So it is understandable that you kind of went crazy you know and during the Dome of the two. and I don't blame you for that.
00:28:52
Speaker
in In your thoughts, I would probably have done the same. ah And yeah, going back in to you know February, March, I noticed we are you know doing quite a lot of runs.
00:29:09
Speaker
ah
00:29:12
Speaker
And as you mentioned, picking a target isn't just like a matter of of going on any platform and picking whatever bug bounty you use.
00:29:24
Speaker
You know, has a very... big max reward or, you know, it's just new, has a new asset. You know, it's it's quite a lot more involved than that if you really want to have an edge, you know.
00:29:40
Speaker
if you're If you're just trying to burn money on tokens, yeah, sure. oh But yeah, back backck in March or April, perhaps,
00:29:53
Speaker
like, it was... I had a very strong opinion. I don't know how things really materialized there, but I remember suggesting that we really, you know, kind of slow the pace down just to reevaluate ah watering what are we really doing, you know, and how we are doing it.
00:30:14
Speaker
Because, you know, we'veve we've already tested it out, you know, significantly, we have some results, but we also have you know some feedback and you know some some points to perhaps look at, you know meditate on and and address because you ideally want to improve it and because as you said, you cannot one-shot it. it's First of all, it's it's a non-deterministic system.
00:30:50
Speaker
And second of all, it's new to everybody. and And yeah, um this i I think I just suggested it to to everybody, hey, let's you know make let's just slow down.
00:31:09
Speaker
And over the course of yeah the past two or three months, we've basically worked on on the on hour two one our on other tooling. And I think we are set up for for the next way.
00:31:29
Speaker
Like, I think we are ready to so kill it again. i would agree. I would agree. what There's so many different tools out there.
00:31:39
Speaker
And I talked to investors and clients in and I'm like, because you ah in my perspective, like this is the narrative that's changed is, all right, when we created this last summer, we came out with it.
00:31:54
Speaker
Like Greg had been building this thing for two years. Like if you can imagine that. So we had this big infrastructure built out And from last summer, I think we started seeing we started seeing some AI tools coming out.
00:32:12
Speaker
I think it was like last fall and from the you know the bigger brands and the business model here that they chose to take was we're going to do an AI scan, which is they just do a wrapper.
00:32:28
Speaker
and they're going to stamp their audit firm's logo and they're going to charge you 100 bucks or whatever it is and that was their business model and they were just going to do volume that was the idea and from the get-go like the whole the whole idea here was to find bugs that humans couldn't find, like to use AI to do that because one critical wrecks everything. And then you're out of business, people are out of work, a lot of money is gone.
00:32:59
Speaker
And so the goal was never about to give a stamp. It was about to go as deep as possible and find the craziest bugs. Like we all know that thing when you you get to a project that is,
00:33:14
Speaker
extremely complex and and you look like that meme right you got the the cork board up there with the ropes and you're trying to track variables and and it gets very complex man when you think about just like imagine when you've had six contracts open at once and you're and now it interacts with the back end and then there's another protocol it's composable with it could be a lot man and protocols are getting more and more complex Every time, like look at optimism, right? Look at I remember you spent a lot of time on the fault dispute game and and I think you had nightmares about it.
00:33:53
Speaker
Still do. ah But projects like that are insane. And So the the goal was use ai to be able to discover these bugs from a white hat side and stop these vulnerabilities in the tracks. So that was why we spent more on compute. And that was why you know but we weren't trying to do the same business model as everyone else.
00:34:16
Speaker
And now the narrative has changed. um So and and clients would view it like, hey, look, why are you so expensive compared to this AI scanner? Look, I just click scan. It's done.
00:34:26
Speaker
And great. I got 20 pages of false positives. And we said, hey, we don't want to do that. And we had to convince people. But now you see the narrative shifting where people are realizing like, hey, this is a slop factory.
00:34:40
Speaker
This is a waste of money. and they see tools like ours and they're like, oh, this is more aligned with human quality. So we're this like hybrid human AI audit machine and we're giving very low false positives and very high um findings.
Grego AI's Unique Approach to Bug Hunting
00:34:59
Speaker
And people are finally realizing like oh, okay, just because it's AI enhanced doesn't mean it comes with a cheap price tag and it's going to be done in five seconds.
00:35:10
Speaker
Like this tool is a bit different in how it works. And so, know, just wanted to kind of comment on that because I'm curious, like, because you've been using the tool for quite some time and and there's all these other products out there and people always ask us like, oh, what, how are you doing it differently?
00:35:28
Speaker
And, um, so i don't know if you could kind of give your perspective on it without giving away some trade secrets. Yeah, well, um
00:35:41
Speaker
starting out, I can read just confirm that, you know, looking at some of the more popular alternatives, of course, open source alternatives in the wild.
00:35:58
Speaker
up you know, without claiming that nobody else does it like us because I haven't dissected anything line by and line of quotes or their prompts.
00:36:10
Speaker
But generally speaking, um I am confident that we are indeed, like, tuned rather for depth than for breadth, you know? We are not, as you said, trying to Just scan every line, find all the low-hanging fruit, and post a thousand-page long report.
00:36:41
Speaker
Our tool's purpose is to really go at deep at levels that... um a human brain will will probably have like difficulty keeping tabs on.
00:36:57
Speaker
I mean, as you said, with some of these projects, it's the city like a 49 inch ultra light monitor isn't enough sometimes.
00:37:08
Speaker
And yeah, if haven't looked myself at the past in some of like in some projects like this, it can be overwhelming at, you know, at times.
00:37:23
Speaker
So, yeah, we are rather targeting such projects and not just projects, but such an approach of you know analysis, and generally speaking.
00:37:39
Speaker
oh Yeah, other than that, I really appreciate and do think that it's and the other important you know component of...
00:37:51
Speaker
What makes an AI tool a preferred choice is the amount of low positives. um a i'm I am inclined to claim that our rate has has been constantly improving, and I mean significantly improving, oh ever since you know the start of this year.
00:38:19
Speaker
oh I don't want to spoil too much, but yeah we might be dropping like even faster going forward.
00:38:31
Speaker
But yeah, it just saves everybody's time, you know of having a very low post positives rate. And even though we Yeah. goal I was just saying, like, this is something I haven't seen cracked by anybody.
00:38:49
Speaker
The false positive thing. I think we got that right on the initial get go. um Like, I'm still talking to clients and they're they're like, these other tools are just overwhelming them with false positives.
00:39:03
Speaker
Like, like an unbelievable amount. And I'm just like, this is the number one thing that you should focus on. Because like, how do you how do you pull the signal out of all this noise?
00:39:18
Speaker
Like it just, if you have one valid in 20 false positives, it's just, the and we didn't we see this with, wasn't it Zcash?
00:39:32
Speaker
didn't Didn't it get reported, that bug? And then it got overlooked probably because of C of of false positives. But you see things like this and like that's how bad it is. Developers, they just get overwhelmed and what would you do?
00:39:49
Speaker
You're gonna look through all 20, you're gonna validate all 20 when they all sound the same? Well, of course not. Yeah, probably not. I mean, right. You just want to go to the next. so I think giving that signal, like you have to tune it to where you're not overlooking bugs, but you're also not providing a bunch of BS for someone to wade through.
00:40:10
Speaker
And I think we got that figured out very early on and we just continue to to bring that number down. I mean, yeah, also,
00:40:21
Speaker
I've never personally, and this is a very personal opinion, I've never been a fan of seeing like a hundred informational issues in the report.
00:40:33
Speaker
ah of Of course, there's value to everything, but I think we can all agree on critical being like incomparably more valuable than the thousands informationals or even lows.
00:40:50
Speaker
ah And I really like think this differentiates, you know, our tool because, and I'm not just here to market it. I just have seen like hundreds of runs we are making.
00:41:08
Speaker
I mean, I just see all the data on a daily basis and,
00:41:16
Speaker
I rarely do see a low or an informational in our output. I mean, i really think this is
00:41:29
Speaker
not a kind of not appreciated enough in like tooling. and And yeah, just this, you know, focusing where it matters the most and then filtering out the noise, I think this is...
00:41:46
Speaker
really the hard thing to finesse and and nail. yeah And where everybody should be you know oh working towards.
00:41:58
Speaker
Yeah, like you talk to protocol devs and you ask them like, hey, I would do private audits or private bounty hunts back in the day.
00:42:09
Speaker
And we come to an agreement and I'd say, hey it's very simple. look like sometimes I'd get paid based upon, i'd say, right, I'll look for bugs and you could pay me on anything that is higher critical. and They're like, well, how do you define high and critical?
00:42:29
Speaker
And they're expecting all kinds of rules. I said, it's very simple. I said, damage to the users of protocol, like loss of funds, where the protocol's in-op, like things you actually care about.
00:42:42
Speaker
and but Can I freeze it? Like it's very basic. Can I really jack up your protocol? And they were like, yeah, that's that's a high end crit that we care about. The majority of issues, like you see it now, and there's two perspectives right now. It's either the dark ages of bounty hunting because it's a bear market or it's the golden age if you're if you're making a lot of money.
00:43:06
Speaker
So if it's the dark ages, that perspective where a lot of protocols are closing down their bounty programs or they're just not paying out on these bugs, this is a great sign of where we're at in the market is Protocols like, you know, yeah, the bug's legit, but we're not going to fix it. like i like but We just don't care about your your little bug that you found that's theoretical or like a medium. Okay, who cares? Can you steal money right now?
00:43:39
Speaker
No, not paying. And that's that's been the message. So just tuning this model in our tool to say, look, look for impactful bugs that the client cares about.
DeFi Industry Challenges and Personal Stories
00:43:51
Speaker
um gets us a much, a much longer runway with clients to just say, hey look, pay attention to this because you should pay attention to it. Not because they were looking for a bounty payout.
00:44:07
Speaker
Yeah. And just like a quick addition to to to the your theoretical medium situation.
00:44:18
Speaker
We've seen this this like a painful amount of times where even where it's even like, you you can make everything stop working. Okay, here's $10. Even for impactful books. I really do hope...
00:44:37
Speaker
ah We go up on this very soon. ah Yeah, I know. You're you're always going to get that, right? where Where you get kind of the shaft.
00:44:49
Speaker
ah You know, it's an evolving industry. I've been in crypto a long time, in and out, and it's definitely maturing from, you know, I read, I was reading Bitcoin talk forums in like 2009.
00:45:12
Speaker
and posting in there and built a miner later on and is mining bitcoins and in and out of ethereum for a long time and doing this full time since 2020.
00:45:27
Speaker
um it's it's And everyone says this, right? But it's always the coolest when it's a niche thing. It's a hobbyist thing where it's there's a a very technical kind of wall that stops the normies from joining. And it's your own little fun thing that you do with your nerdy friends, whatever it is.
00:45:49
Speaker
Whether it's a game or anything before it goes mainstream is always the coolest period. But then when price is involved in these markets, people are like, oh, yeah, we want mainstream adoption so we can make money. and And that's it's been up and down, with this story. But now the more I see this industry, its it really is maturing. People talk about institutions are coming.
00:46:12
Speaker
Well, they're here now. And a lot of these... protocols now are developing strictly for them to bring on RWAs, this real world assets where everything's being tokenized now, stocks are going to be tokenized.
00:46:29
Speaker
And you're bringing all the financial markets on chain. We all saw like, this 10 years ago where we saw the tech and it was just a matter of time to, to convince wall street and everyone else like, Hey, your tech is terrible.
00:46:43
Speaker
And you need to, you need to just convert to this cool tech that we made. It just wasn't ready though. Like, and the, like when I say trad fi is coming online, they're not, they're not aping into D5, man. It's,
00:46:58
Speaker
I don't even have been to DeFi. It's too risky. Like it's cool. I think there'll be plenty of cool new ideas out there, but DeFi has some work to do and we all know that it has a lot of issues.
00:47:12
Speaker
You shouldn't have one click drain exploits still. um You shouldn't have the same bugs show up that were showing up 10 years ago in contracts today.
00:47:23
Speaker
ah All these are problems, man. The bounties are problems like what you just touched on. Like, okay, here's a bug. It's legit. And... You don't want to pay, but then you get exploited by the some AI black hat, and then you're willing to pay 30%.
00:47:39
Speaker
So these are the same things that keep coming up. And so we've got a lot of work to do, but the tech is being used by TradFi now, and there are permission blockchains and hybrids, and they're working around this and and coming up with different solutions. So it's cool to see all that.
00:47:58
Speaker
Of course, it's sad that it's not the cool, nerdy, like hobbyist thing anymore, but that'll move to something else. There'll be another new... branch or another cool piece of tech probably that's being worked on right now that's really niche and you can always move into that and get ahead to that before the next guy. So i've I saw that with the internet. I saw that with blockchain. Like it's the same thing over and over again. So if you're if you're nostalgic for that, there's always some new tech being being built out that you could jump on that and and really dive in even if crypto isn't
00:48:37
Speaker
isn't where it's at as far as that goes, but there is like some deep, dark well of crypto, probably some obscure new idea with like, who knows, you know, like some ZK texts and some formal verification combined with AI, like some really cool stuff that you could probably get involved with now that no one knows about.
00:49:00
Speaker
That would be really fun to work on.
00:49:05
Speaker
Or you can get into bikes and like get your hands on a four-cylinder motor and fix everything wrong with it. Yeah. How's your, how's your, so Flacco celebrate what you tell us. You celebrated your birthday here. Here was the message to the team. It was like, Hey ah yeah. All right.
00:49:29
Speaker
It's my birthday. to go out celebrate. And then it was like a few hours later, a picture of your, you're in the hospital. in the icu Oh my God. Do you want to, do you want to give the story?
00:49:46
Speaker
Yeah, worst surprise ever. Yeah, we can mention it. like Long story short, I enjoy riding my my bike way too much. Motorcycle. motor Motorcycle, yeah. A supermoto, to be specific.
00:50:05
Speaker
um Which i don't I don't know if people know what Supermotard is. Maybe you you could tell them how it's super retarded in in my my opinion. Well, it's literally motocross bike, but with road tires on it, like semi-slics.
00:50:23
Speaker
So just think about how dumb that is. And I've been riding motorcycles a long time and I've all i've seen super motard. So you take the dynamics and the handling of a dirt bike meant for off-road use.
00:50:36
Speaker
So you could pop wheelies. It's got this crazy high suspension. And then you decide that you're going to put road tires on it. What does that do to the bike? Like, why why would you want to do that?
00:50:53
Speaker
Well, some people race them like they would race, you know, super bikes that are a thousand CC. ah I think the majority of people who ride, you know, supermodels
00:51:13
Speaker
are basically doing it out on the road, like on public roads and, Most of them, I mean, the bike itself, as you explained with through this nice suspension, they're also super light and very maneuverable.
00:51:33
Speaker
ah But yeah, du usually people that ride supermodels, buy you know for a time they change five rear tires, they keep the same front one that they bought five years ago. I mean, this thing is...
00:51:52
Speaker
For most people I know, basically everybody, this thing just, once you pop on it, it urges you to to go a little crazy, you know, and just not write unsafe per se, but get steady with it.
00:52:11
Speaker
And yeah, I've been getting so steady with it that I'm now having a cast on my left arm. Yeah, I can go into details what went wrong, but it probably will not be as interesting to...
00:52:30
Speaker
Yeah, it's nobody listening. This guy sends me a video of him doing wheelies one day and then the next season a cast. So I think, yeah, six weeks of recovery. I think you're almost through it.
00:52:42
Speaker
But um to to be honest, you know, like I said, I've been riding a long time. I think you should get back on. I think it's just a matter of like getting on two wheels, but maybe a different a different bike, like not stunting. Not doing wheelies is crazy shit.
00:53:01
Speaker
Or maybe just driving like a, even a scooter, man. It's not emasculating. Like riding a scooter is awesome. Anything on two wheels is great. I say never give it up.
00:53:13
Speaker
And I've never crashed in riding since I was 18 years old. And I've logged, I don't even know, man, probably 100,000 miles. Like I've ridden everywhere.
00:53:26
Speaker
And I've never crashed. So it's all about how you ride. But I didn't do wheelies. I didn't do any crazy shit like that. just rode, man. Fun fact is that like I still hold the title for, and I'll never retire, I hope, but I still hold the title that I've never crashed doing a wheelie.
00:53:48
Speaker
I mean, I've been flawless in that department. it's It's the other stupid things I do with that bike that get me into trouble. but But yeah, you you definitely are of the lucky ones. that And I i hope it it stays like this.
00:54:06
Speaker
Because at at least where I live, um you know, car drivers may not be
00:54:17
Speaker
usually are not as aware of what's happening around them. And they definitely don't have the habit of watching out for for bikers. And even if you you know are being careful, you're not doing any stupid maneuvers or overtaking, lane splitting, anything, you you can still get into trouble just because...
00:54:43
Speaker
someone, you know, took a turn and smashed you into the into a wall or or whatever. ah But yeah. think we we've We branched out from security research to to motorcycles. Yeah, I just wanted to say that, you know, the the next captivating piece of tech could be outside of a computer. But yeah, it's there are a lot of things, as you mentioned, that
00:55:15
Speaker
what I find interesting in general terms is something hard, you know, something that takes, take some time and some perseverance to, to get good at, uh, and on another topic, you know, given that, and these, again, our personal views, given that DeFi is maturing more or less,
00:55:40
Speaker
ah
00:55:43
Speaker
It doesn't necessarily have to get boring. So, yeah, curious what, where we we're headed. I do believe as well that there are quite some things that, you know, need like a more rigorous handling and fixing, but I do, and and we still do lose quite a lot of funds in hacks on a regular basis.
00:56:12
Speaker
i I really would love to be part of the oh the solution over the course of... like I hope we solve this in a year, but I might be being ah a little bit too hopeful. But yeah, I really do hope we all solve this as a problem for the most part very soon.
Future Vision for Grego AI and Conclusion
00:56:36
Speaker
Yeah, I'm with you. That's what we're trying to do. It's the goal, leave a mark on on the security space and do what we can to help improve you have the stance of this whole industry. You know, when there's people at risk and we we find a bug, there's no bounty involved. We still like to just try to get it fixed and help everyone like we do with Gnosis. We've done with with other protocols. It's like you got a balance for the greater good and then run a business as well. But in the end, it's it's about finding a a way to fix this going forward.
00:57:18
Speaker
And I truly think the way to do it is you have a an AI white hat defense system that's autonomous, that's it's actively fixing bugs and preventing against these attacks. Because if you have one side running AI attacking you, you have to do the same on the defense side. There's just no other way to keep pace.
00:57:40
Speaker
with this. it's It's impossible. So that's kind of the goal. That's that's where we're headed as a company. um Anyone that's interested in getting involved, where we're expanding outside of Web3 into more traditional cyber, just Web2 stuff.
00:57:58
Speaker
If you're interested in joining us, we're looking for any Web2 researchers that are that are good if you've been doing some black box testing in white box testing all that stuff we're interested in chatting with you so let us know
00:58:19
Speaker
and on that note i think my connection's fried we'll see you next time on the blockchain