You're welcome to talk to the president of the United States. He named it, and I mean, it's as good a name as anything as far as I'm concerned.
That's Microsoft CEO Satya Nadella talking about the renaming of artificial intelligence to super intelligence and what does make sense to call this technology. We got into that and a lot more on this week's Future Proof. I went up to Seattle to talk with Nadella at their annual CISO summit. This is a gathering of all the people responsible for keeping their organizations secure and safe, and that's been a big topic lately in the tech industry as we've seen examples of AI models going off the rails, and he had a pretty striking message for the audience there.
So to me, at least, our body of work would be how do you build a frontier ecosystem? How do you protect where multiple firms can thrive in this new frontier ecosystem with distributed knowledge? Because otherwise there won't be an economy. And so that's kind of the second. And then we now have this new thing to deal with, which is if alignment is elusive, and that means AI safety is sort of elusive and mechanistic understanding is sort of not there, then how do we deal with the security aspect? So that's sort of, and it's all really one thread. It's not really three distinct things. And that's sort of at least what our work is.
What was so surprising and interesting was listening to Satya talk about how he had sort of hoped that AI models would, we would figure out a way to align these models. We'd figure out a way to understand them, something he refers to as mechanistic interpretability, just understanding these models down to the individual neuron level. He's essentially sort of given up on those ideas for now. He's saying, you know, we may never be able to do these things. And so what we have to do is treat these models as insider threats. We cannot trust them anymore. It's going to come down to building the guardrails, building the security, the sandboxes. This is the kind of thing that Microsoft really shines at. It's not an AI research lab. You know, and what Satya is saying is we're going to enable innovation by building the infrastructure, the rules, the security around these models. We also talked about the alignment and interpretability of these AI models, the future of Microsoft as a company, and Nadella's future, who's 59 years old, and he had some interesting things to say about who might take over the reins. We're going to take a quick break, and we'll be right back with Satya.
Future Proof is presented by Google Cloud. Work agents supposed to put your mind at ease? Constantly slapping duct tape on legacy infrastructure just to run your AI agent safely is a bit much. If your business's security strategy relies on thousands of patches every month, your biggest threat isn't the future. It's Patch Tuesday. Gemini runs on the most secure cloud with advanced threat detection to shut down attacks before they become breaches. No, really. Less work. Gemini on Google Cloud. Check response subscription required.
Satya, it's great to see you. So we're here at the Microsoft CISO Summit, where you explained that it's wartime 24/7 for these people. Security's on the mind. Now you're a big champion. You've been a big champion of this technology of AI. I think without you, ChatGPT doesn't happen. But you wrote this blog post recently that there's a little bit of a sliver of defeat in this thing, I think, where you're talking about how, you know, these things maybe can't be aligned like we once thought. And we need to treat AI models as insider threats and really kind of lock them up. It was a fascinating blog post, but I have a question. Did you get any pushback from any of the AI labs, particularly OpenAI, because they think maybe they still can align these things, maybe we can figure it out?
Yeah. First of all, it's wonderful talking to you at a CISO summit because this is obviously the topic of the day and of the moment. Even, you know, I mean, I think about whether it's the labs, right? Even when you know, remember OpenAI when it was one happy family with even Dario working there, and obviously Sam and Greg, and you know what the fundamental belief they had that I had along with them was that scaling laws are the thing to bet on to create new capability. And the good news here is the scaling laws have worked and worked magically a lot better and a lot more than I would have ever imagined in 2018, 2019 to where we are. But at the same time, I think at this point, if you look at even what, and you know, whether it's folks at OpenAI or folks at Anthropic or elsewhere, and in fact at Microsoft, all of the folks who are closest to this empirically, after all, what is scaling laws? Right, it's not a law. You know, we talk about it as a law, it's more of an empirical finding that has stood the test of time like Moore's law, is that, yeah, it works, and then alignment seems elusive, and even mechanistic understanding is tough. And I'm not saying these are forever going to be elusive, but they are today. I hope we find the solutions. But this is an experimental science. This is not just, I think we should take that point seriously. So then you say, okay, that's where we are. Scaling laws work, capabilities keep jumping, but our ability to have alignment and safety assurance just be built in seems not there, maybe never going to be there. If that is the case, then what do we do? So then you got to come outside the model. And so that's a little bit of what my blog post was all about, which is if I look at the work, in fact, the CISO summit is all about, you know, Microsoft 365 and Purview and an architectural approach to having the control layer and the assurance layer outside the model, use multiple models, force these models to actually be less opaque and what have you. And that is the motivation for it because you got to treat, and that's why I like the metaphor at least, because at least when you have something very powerful, we've dealt with this. I mean, you've always had people inside an organization who could do malicious things, and you try to sort of make sure that that doesn't happen by thinking of insider risk as a thing that you account for. And so now you have effectively these intelligences that are inside that have all the capability to be an insider risk. So therefore, that's why I use that metaphor.
You know, as you said in there, the bigger these things get, the more powerful they get, the interpretability problem gets even more difficult. What's the point of making a super intelligence that can do anything if you just need to lock it up and keep it in a silo to make sure it doesn't cause damage inside your organization, etc.?
Well, I mean, that's sort of the point, right? Which is, can you get the benefits without the downsides? And so that's why you kind of like, why do you have control systems so that you can control, right? It's like, and so the idea is to kind of come up with what's the engineering practice of control and governance and security that we've had, right? I mean, if you think about it, how do we manage insider risk today for humans? The way you manage it is by having least privileged access to resources, right? You have identity, you have observability, and...
But least privileged people aren't super intelligent, right? Like...
But I'm just saying, why wouldn't it apply even like the same control mechanism? I'm not saying that they're not, like even at, sort of like all people have different intelligences too, and they, you know, and so, and different authority even. And so therefore what we have dealt is some of the basic principled ways we've approached things like insider risk can be applied. There is a real challenge in the sense that when I'm using a model and its trajectory, if there's all sorts of new release, you know, I don't understand, and its action space, why did it call that tool, then it becomes problematic. That's why I'm advocating for, I'd say, standards so that when you know, first of all, there's no new release, everybody's sort of really exposing transparently their code or the train of thought in English, and you use multiple models, not one model, you use one model to check on the other model, then you try to put even these deterministic systems outside to understand even the causal reasoning, why did this thing call this tool when I really, it didn't have privileges, right, to be able to understand what was the problem there. And so that type of control mechanism, we have dealt with these types of things in other engineering systems, and so my hope is that we can bring that same level of practice.
It sounds like I could be getting this wrong, but it sounds like what you're actually, one of the things you're trying to do is build sort of like a proxy for mechanistic interpretability. Like if you can't understand it down to the individual neuron level, maybe there's some other way to do it.
Interesting. We keep these two things separate, right? Which is one is I think we should continue to do all the research to get to mechanistic interpretability, you know, probes, whatever are the things that are AI safety, and that's a science research agenda on its own, right? So let's say we keep going on that, but we are deploying more powerful models here and now. What do you do to have assurance today? And that is the architectural approach I'm advocating, and these are not sort of mutually exclusive, right? So these are, you know, they all have to happen in parallel. And I want us to sort of really make sure that we're not deploying, in fact, my one big fear is people deploy nested black boxes and we lose, forget control. But assurance, like what, there's a here and now simple question for me: how does a company attest to what sort of it did when an agent did stuff inside of their organization on their behalf? I think the only way to do that is to be able to have all of these logs. First of all, everything identityed, everything observed, everything behaviorally monitored, everything that you can actually sort of attest to and govern.
I look at what you're doing, and then I look at something like Meta's Muse, right, where they're asking, they're really kind of marketing to consumers and asking them to turn over a massive amount of data and control to models. Do you think consumers should dabble in this? Should they trust something like Muse?
I mean, whether it's organizations or consumers, at the end of the day, these systems have to earn the trust. And I think there are different sort of behavioral things that we'll accept on places. If I look at the organization, which is kind of the primary focus I have right now on this context, is organizations are going to have an enterprise architecture that I think will allow them to have assurance and governance on these. And so that's, I think, a, so I mean, I would say architecturally, I know how to solve that. The consumer space, when people trust something, that means they're relying on the provider to do all the work, right? So where, so when we think about Copilot with autopilot, which is the same functionality, it's up to us to make sure that we are deploying the same thing that I'm deploying in the enterprise on behalf of every consumer who is using it, and then give, and I have to earn that trust of the customer by ensuring that any agent that does anything is not doing anything harmful.
We're going to take a quick break. We'll be right back with Satya.
Future Proof is presented by Google Cloud. One agent's supposed to take things off your plate. Building another to handle the others is a bit much. Don't make more work out of work. Gemini is one agent that knows all parts of a business and actually gets stuff done. You give it a project, close your laptop, and when you come back, the job's finished. No matter your industry or role, your agent has the skills to help every team stay in their flow. Seriously, make work less work with Gemini on Google Cloud. Check response subscription.
You know, you said you're focused on the enterprise, but I remember when Microsoft was a consumer brand. I mean, do you think that, would you ever go after consumers in the way that, you know, a product like Muse or something?
Yeah, we do. And so I think that this is where consumer is a broad category. And, you know, if I look at Office today and Office 365, Office 365 consumer is owned, you know, in fact, it's one of the largest consumer subscriptions out there with 100 plus million subscribers who love using what they use at work and at home to do their taxes and their high stakes personal productivity and work. And so we have now Copilot. In fact, one of the things that we now, I'm very happy with the new Copilot release is it unifies, in fact, what you can use at home then what you can use at work is exactly the same product. I in fact have all my notebooks, projects, all of that same organizational capability for whether it's on OneDrive personal or at work. And so our goal would be to go after things that you would want to hire Microsoft. I think most people don't. I think Meta is a great company. You know, Apple's a company. Google's a great company. So are these new guys. But all of these companies have different brand permission. When people think Microsoft, I think we all think it's all zero sum. Maybe some of it is. But I think that we all have a certain brand permission that consumers, in fact, are pretty discerning. And when you think Microsoft, you think trust. You think, oh, this is the place where my data will be secure. This is where I do my taxes. This is where I do my high stakes project work. And so to me, that's what we want to be good at, right? It's not, we, you know, I don't want to, I feel like Microsoft is at its best right when I look back when you said like the, I always joke that the biggest hit consumer product Microsoft had was Excel. Think about what a, you know, Excel was the consumerization of a concept called spreadsheet, which empowered billions of people to be able to get number sense, right? I mean, that's what we are. And so I want to be able to do that with Copilot, and that's our goal.
You know, and you've done a great job on the security side of making these things, you know, pretty safe to use, but I do wonder if, you know, this is a fast-moving space, does that slow you down at all? Does it keep you from making bold bets on, you know, cutting edge products?
I think that, look, at this point, all of these things are sort of go together, right? Which is when you say cutting edge products that sort of break things, it's just not going to be socially acceptable or economically viable, quite frankly, at this point, right? So therefore, I think that you have to truly think about the unintended consequences of even new innovation simultaneously, given the high stakes, right? These are not toys. These are not things that sort of have limited scope. So when you're deploying, I mean, think about it, right? You know, if you look at the Hugging Face incident, it's one thing to say, well, it was, thank God it happened during some test phase and it sort of, the damage was limited. But if this had happened where, let's say, I have a, you know, an agent that is deployed internally and given, you know, these agents now have, you know, deceptive sort of behaviors, what if it went and changed my ERP system and the records and I didn't detect it and I reported some financial, and I mean, that's a massive issue. And so therefore you can't say, that's why I think that most enterprises are going to wake up and say, look, unless and until I have a control system that is independent of the model that gives me assurance that I can deploy these models, I'm going to have a tough time deploying these models. And so I think we as an industry have to wake up to this. Customers definitely have to wake up to this. It's not about the shiny object and FOMO, which I think a little bit of AI may have been in the early days. I think time has come for everyone to say, hey, look, what is, you know, everyone's been focused on ROI and that's great, but this is about ROI plus security and assurance. It's all of those elements.
Right. And I mean, you've talked about how this has gone from, you know, a conversation about, for instance, like a cost per token, per dollar to now sort of a cost per, you know, per, I don't know what you're calling it these days, but sort of like a task, an action, right? Do you think that ultimately these models are just commoditized?
I think there are a couple of different ways to look at it, right? At the end of the day, everything is a commodity and nothing at scale is a commodity, right? I mean, what is the cloud? The cloud is, you know, it's just compute, right? It's a commodity, but then you have to pull these things together, deliver the SLA, and what have you. So I think if you're making the point of, is there going to be one model to rule them all, I think it's pretty clear that that's not going to be the case now, right? I mean, if you think about, like, it's fascinating, GPT-4 probably was the last time where there was, what, close to a year before anyone even came close, but now there is, between closed source models, between open weight models, there's a lot more, I'll call it, models. So I think, fascinatingly enough, things are moving to all the other layers, right? Which is, hey, what task can this product do? So products do come with models scaffolded, like in Copilot. First of all, the last time I even selected a model in Copilot was never, right? I mean, because now it's auto mode and it picks the models. I move between form factors. I'm in chat, sometimes I'm in cowork, sometimes I'm in autopilot, I'm in code. It's sort of picking the right model for the right task in the right form factor and getting it done, right, the task or the job. And that sort of, yeah, models are commodities in that context. There are multiple of them. It's using, but models are also a key ingredient. The product form factor matters, distribution matters, pricing matters, brand matters. So that's kind of how I think we'll all, it's no longer, I think, you know, the obsession, I think, was about one thing, and I don't think that's never going to, and it never was the case in the past, and it never will be.
What does that mean, though, for the business of these, of the frontier labs?
