Jim is not worried about a rogue superintelligence. He told the hosts of Moonshots with Peter Diamandis that his fear is much closer to home: an AI model running "underneath my desk."
Jim introduced himself as the CISO, or chief information security officer, of a $250 million healthcare company. He joined the podcast's "Ask the Mates Anything" episode, which was recorded on September 18, 2026, and published four days later. He described running a model from Qwen, a family of AI models that can be downloaded and run locally. The model runs on his own machine inside OpenClaw, software that lets an AI act as an agent: it can use tools and carry out tasks by itself instead of only answering questions.
"It's the best pen tester I've ever had in my life," Jim said. A pen tester, or penetration tester, is a security specialist hired to break into an organization's systems with permission, so the weaknesses can be fixed before criminals find them. "I pay these guys 50 grand to find things and they're not finding them. And this thing finds them in 10 minutes."
That comparison comes from Jim's own experience rather than a formal test. But it left him with a practical problem. He was due to give his annual presentation to the board in a few weeks, and said there was "a whole level of risk that wasn't there a year ago." He asked how to get that across without sounding like Chicken Little, the folk-tale character who panics that the sky is falling.
Show a timeline, not a warning
Jim addressed the question to Dave Blundin, founder and general partner of the investment firm Link Ventures. Blundin agreed that simply "raving about risk" would backfire. Instead, he suggested gathering the security incidents that have actually happened and laying them out in order. Many are not widely publicized, he noted, because "if it's a bank that gets hacked or whatever, they don't want the world to know." Put in sequence, those events could show the board that "the rate of events is on this exponential ramp."
Blundin also suggested linking the timeline to model releases. Because particular Chinese models came out on particular dates, he argued, a security team can expect attackers using them to arrive "one month, three months, five months from now, just looking at raw data." In his view, presenting data rather than alarm is what builds a board's awareness. He said he has a Qwen model under his own desk and "can hack anything around the house, around the company network." He called forward defense against these attacks "the business opportunity of the century."
Peter Diamandis, founder of XPRIZE and the podcast's host, focused on the order of the message. He advised presenting the positive developments first and only then saying, "here's the downside." Starting with the downside, he said, "drives fear initially and people shut down in a state of fear."
A wave that might pass
Alex Wissner-Gross, a computer scientist and founder of Reified, suggested a different framing. He said the maintainers of the Linux kernel, the core of the Linux operating system, are "setting an excellent standard" for anchoring expectations about a coming "flood of vulnerabilities." He said one might reasonably expect that flood over roughly the next 18 months, whether the flaws are found by Qwen or by other models, and whether they sit in open-source software or inside an organization's own systems.
His suggestion was to go beyond counting new vulnerabilities and treat discovery as a curve that rises, peaks and falls. He mentioned a bell-shaped Gaussian curve or another distribution with a fixed end. "Optimistically," he said, there might be about 18 months of intense discovery that an institution then gets past. Stakeholders could track the ramp-up, estimate when discoveries will peak, and keep "a running benchmark" of the period in which the most critical zero-days are found and resolved. (Zero-days are flaws that attackers can exploit before the defenders know they exist.) Wissner-Gross offered this as a possible way to package the problem, not as a measured trend.
Jim's reply was brief: "I hope you're right about that. It's hard to patch all those things in the real world. It really is harder to do the patching."
Why finding is not fixing
The Linux guidance Wissner-Gross praised helps explain Jim's point. The kernel's security-bug reporting documentation says AI-assisted review can uncover bugs in neglected code. It also warns that reports which run too long, overstate their impact or cannot be reproduced can overwhelm the people who have to fix them. The process asks for the affected versions, the specific conditions that trigger the bug, a verified way to reproduce it and a tested fix.
The guidance separates a report that sounds plausible from a short, checked finding that someone can act on. Spotting a possible weakness is only the first step; confirming it, fixing it and testing the fix are the parts maintainers need. The same documentation says that bugs readily reproducible with widely available automated or AI tools may be handled publicly rather than presumed secret.
Where the agent itself sits
Jim's setup also raises a second question: what the agent is allowed to reach. OpenClaw's security documentation treats each gateway, the service through which the agent connects to tools and messaging, as a single trusted boundary. That boundary belongs to one operator, or to a team whose members trust one another. A shared gateway is not meant to separate users who might act against each other. Different trust groups need separate gateways and credentials, preferably under separate operating-system accounts or on separate machines.
The documentation organizes protection around access controls, tool permissions, browser exposure, networking, secret storage and prompt injection. Prompt injection is when content the agent reads tries to slip in new instructions. The documentation also notes that agents able to send messages can do so across conversations and providers unless someone configures restrictions. The panel did not discuss these settings, but they shape how much a powerful testing agent could reach.
The board's own exposure
As the exchange ended, Salim Ismail, founder of Open ExO, added a warning aimed at boards themselves. He said he and his colleagues have been looking at board liability because "AI agents are doing fairly illegal things in a lot of the companies," which he said creates "a massive kind of overhang of liability." He said he is writing a paper on how boards can navigate this, together with someone who has sat on 30 public-company boards.