DeepSeek's Jailbreaks Don't Matter. Giving the Model Arms and Legs Does

When Sequoia emailed Nikesh Arora to guest on Training Data, he wrote back with a condition: they could have him if they talked about DeepSeek and the new world order. Hosts Pat Grady and Sonya Huang took the deal. Since 2018 Arora has run Palo Alto Networks, now the largest and most valuable cybersecurity company in the world by their count — 70,000 customers and more than $120 billion of market value. Before that he spent a decade as Google's chief business officer while revenue grew from about $3 billion to $65 billion, with T-Mobile and SoftBank further back in the résumé.

Grady opened with a fresh report: DeepSeek R1 had fallen to 50 out of 50 prompt-injection attacks, a 100% success rate. Arora's answer was that it does not really matter. Every model is raw until someone pays to wrap guardrails around it. Early ChatGPT and the pre-Gemini Google models were jailbroken too; expensive models still have side doors. DeepSeek may be thinly guarded because it was built cheaply. The question is what you intend to do with the brain once you have it.

"Whichever model it is, when you deploy it for a precision use case and give it arms and legs," he said, you will have to superimpose better guardrails and controls. That is Palo Alto's opening: an AI firewall, a straitjacket that lets the model improve a manufacturing process and will not rewrite Shakespeare. The company sees two live use cases. Employees are using AI as human augmentation — mail, research, drafting — and enterprises fear proprietary data walking into a public model and becoming someone else's training set; Palo Alto intercepts that traffic and gives the company visibility and a kill switch. Separately, almost every customer is running an AI project, most often a customer-service chatbot or workflow automation, and the bolder ones are edging toward non-critical control systems. The fear there is hijack, wrong answers, or a model that takes over. Model behavior, Arora says, is the model maker's job. His job is to make sure the brain does not get intercepted or manipulated.

Arora's own mental model is blunt: a large language model is a brain with huge memory, processing, and pattern recognition. Trained on public data, it will reach the wrong conclusions — hallucination, in the industry's word. The fork in the road is when you attach arms and legs and let it act. Give it power too soon and you get the other kind of hallucination: companies that let models give away free cars or refund airline tickets. Give it a narrow, task-specific job and you get Waymo, where passengers already sit in cars with no driver. Precision use cases are already being trusted.

He refused to referee whether DeepSeek cost $6 million. The point, he said, is that a cheaply built, cheaply offered brain expands the set of people who can put that brain on a task. For years the industry consensus was that amazing models require amazing sums. Task-specific models may be much cheaper. That, to him, is the new world order. Huang asked whether AI labs get nationalized in his supreme-ruler hypothetical. He does not think so. If a strong model can be produced for single-digit millions or tens of millions, the lab can sit in any lightly regulated country and you will not find it. Fifty million dollars in a server cluster is enough. Oversight only starts to look plausible if AGI requires a $500 billion supercluster.

Asked to design the regulation himself, he split the world in two. Critical systems — shipping routes, cargo, the electrical grid — should not get AI control without a certification process closer to FDA drug approval, because the damage is irreversible. Everywhere else, self-accountability: carmakers are on the hook for seat belts even though every car is not inspected. Deploy AI badly inside your company and the responsibility is yours, because no regulator can inspect this much compute and data and get it right every time. Grady then pulled a 1999 artifact: Arora, then an award-winning telecom analyst, wrote a sell note in November of that year warning about the internet bubble. He still has the note. Is this an AI bubble? "Lightning doesn't strike twice. How would I know?" What is different, he said, is that the inflation is in the plumbing, and the plumbing is real — chips selling four to ten times what they did two years ago, with real revenue underneath. The projected trajectories he does not understand. The open question he left on the table: is Stargate the future, or is DeepSeek — a $500 billion super-brain, or a swarm of cheaper specialized models?

Huang asked which AI threats are real and which are academic — the self-driving-era panic about adversarial stickers on the road that would turn cars into weapons, a risk that stayed theoretical. Arora did not put LLM attacks in that bucket. Adversaries are already using language models to move faster. Hugging Face hosts some 3,000 models; pick one without guardrails or "morals," feed it a CVE, and ask for the five steps to exploit it. Or tell it you tried option A and option B, show the error the system returned, and it will suggest option C. That is not a paper risk. It is happening, and it compresses mean time to attack and exfiltrate.

Defense is an unbalanced game: attackers have to be right once, defenders 100% of the time. The only way to keep up, he argued, is to ingest the entire corpus of enterprise logs from every IT system and look, in real time, for almost-activity driven by AI. Palo Alto's XSIAM platform is built for that. Grady asked whether, at the margin, AI currently helps the bad guys more. Arora sold his book — customers on XSIAM can match the pace — then conceded the point: the tools are not fully deployed, so yes, attacking got faster. Play the movie forward five years and you get agent-versus-agent war inside the infrastructure: attacking agents hunting unlocked doors, defending agents locking them. He does not think that is infeasible. Getting there, though, requires a serious upheaval of enterprise data, the same cleanup companies need if they want AI to run the business.

The hypothetical he takes seriously is capability, not stickers. Assume the model reaches a PhD researcher at your favorite university and you train it on proprietary Alzheimer's and Parkinson's data. Ask it for an antidote and society wins. Ask the same trained brain, with no guardrails, to make a virus, and you have a bioweapon. The hard problem is not whether the model can think. It is whether that trained brain can be kept out of the wrong hands.

Grady put on the hat of a frightened CEO: AI looks useful, employees using it look like a bigger attack surface, and adversaries will sneak in ways they could not before. What are the top three things to do? Arora called the fear ill-informed. Run the model in a constrained on-prem or dedicated cloud cluster that cannot be intercepted. Feed it your data. Let it generate answers and give it no control. A/B-test those answers against your best researcher. Some things will be faster, some better, some both. That experiment is available today. "It would be irresponsible for companies to not experiment," he said, "because I don't think that this thing's going away." Control rights are a later, more interesting problem — and they demand rigorous testing, because the blast radius is the business.

He learned the same way he wants customers to. On a flight to India in late 2022 he read about ChatGPT, then sat at Dubai airport for two hours and rewrote his entire speech. He told the audience they were about to witness the biggest technological revolution — an iPhone-moment line he now jokes Jensen Huang got credit for, because Huang has a bigger mouth and is "supreme commander of AI." Back at the office he asked his team what they knew. Nothing, but they had opinions. He put the executives in a training room, invited Thomas Kurian's Google Cloud team, Matt Garman's AWS team, and a string of startups, and ran two-day brain dumps every month. Seventy ideas came in; they cut to seven. They ran everything they could through Vertex AI, early ChatGPT, and early Claude, semantic search and training data included, until they knew what was useful.

The surprise from those early models was pattern recognition, summarization, and what he calls infinite memory. Fifty people used to solve the same customer problem fifty ways, depending on who picked up the phone. Now the model gives a baseline and humans work from there, which lifted the average capability of the team. The warning is the one every platform shift taught: if every startup is learning and you are not, the startups do your business. Cloud, mobile, internet — large incumbents held every asset and still watched a Travis, a Chad Hurley, a Larry Page, a Mark Zuckerberg appear around the corner.

Later he sketched the AI chessboard as clearer than it looks. At one extreme are AlphaGo-style fine-tunes — DeepMind's task-specific work, including drug discovery. At the other are Claude, Gemini, and OpenAI, the general models. Search already showed the sequel: Google could not own local search or product search, so specialists and Amazon did. GlaxoSmithKline, Novartis, and Pfizer are not going to pool data into one perfect drug-discovery model. Enterprise work needs precision: a wrong Tesla turn can kill someone; a wrong Palo Alto block can take down a customer's infrastructure. High-consequence settings need better models and more precise domain data than consumer chat can tolerate. On the general-model end, whoever can wire AI into an existing consumer property is sitting pretty — Google's three-billion-plus users, Meta's three billion across Facebook, Instagram, and WhatsApp. Sam Altman's moat, as Arora sees it, is the subscription consumer channel nobody else has built.

Huang asked whether AI is the next platform shift that mints a new security giant, the way firewalls, identity, and cloud did. Arora thinks it can turn the whole category over. Security is a needle-in-a-haystack problem: you do not worry until you have to, and then you must go from zero to expert overnight because someone is in the network exfiltrating data. Traditionally, he said, about 95% of spend sits on the border — firewalls, endpoint agents, XDR — and 5% on detection and remediation. Prevention works, until it doesn't. Zero-days have never been seen, so they have no signature. The only way through is to ingest a lot of data, look for anomalous behavior, and do pattern recognition on the fly. That, at real-time speed, is an AI problem.

At first principles, security companies sell two things: sensors at the edge of whatever the perimeter is — laptop, application, the customer hitting a bank account — and backend analytics that hunt vulnerabilities created by the infrastructure you already have. If you want to sell an AI-powered anything, you have to sit at those collection points, because AI is hungry for data. Palo Alto, with 27 products in Gartner's Magic Quadrant, is in that seat. History, he added, is unkind to people who sit there and get lazy; they get knocked off. Startups face a different wall. They have to ask the customer to deploy a new ring of sensors and then hand over all the data. "You want all my data? Who are you again?" Large-data problems, he said, are hard to solve as a startup — some raise $500 million, but not everyone can.

Are security teams comfortable giving agents arms and legs? "They're petrified." He does not think they get asked. Waymo would not exist if the security lead had a veto; Tesla FSD would not either. CISOs are risk managers. The safest room has no windows and no doors, and it is useless. Their job is to understand the business need, attach the least risk they can, set gates one through three, and then let the thing run. They will allow arms and legs because that is the crying need of the hour. The question is which tools make customers comfortable enough to proceed — the same question every new technology has asked.

Sequoia partner Jim Goetz has been around Palo Alto since formation, and Grady relayed two of his questions: how would Arora grade the company's nimbleness, and how do you keep a scaled organization fast? Arora gave a seven or seven-and-a-half out of ten. Fifteen thousand people, five or six thousand of them in product, 70,000 customers whose infrastructure you cannot afford to take down. Inline security loses its license to operate if a tweak lands badly; availability is a higher precision standard than throwing things at the wall. Seven years ago he figures the industry was a three or four. Newer players now chase instead of congratulating whoever entered the new swim lane.

Agility, for him, is three habits. Embrace the team of 50 to 100 venture-backed people running at light speed before they become the daily competitor — Palo Alto has done that 19 times, while still building more than half its products in-house, because at this scale innovating on the platform often beats bolting on the fastest outsider. When you get punched, recover before anyone counts to ten. And then what he calls relentless inspection. A year and a half ago, in a tough quarter, sales leadership insisted every account had a plan. He did not believe it. He started at customer number one: five slides, a Zoom, explain it to him. He has now sat through about 750 of those reviews, 15 of them the day before the taping, with 500 employees dialed in to watch. President BJ Jenkins and product leaders jump in when a plan is thin; people on the call open LinkedIn and text for a missing relationship while the meeting is still going. A whiteboard in his office has a second line: sales is a math problem. If the product is generating billions in TCV, a loss is usually an execution error, not a product indictment.

On people he does not suffer fools, because he can fix many things and cannot fix intelligence. Domain knowledge still matters: founder Nir Zuk and chief product officer Lee Klarich are the sounding board he challenges and who push back. Attitude matters as much — willing to learn, humble, part of a team. The all-hands joke is that he has never met a person who comes to work to screw up. If you hired the right person, unintended outcomes are something the workplace created. Leadership, as he teaches it, is three jobs: pick the mountain so your best climbers are not scattered across eight peaks; write a feasible plan and resource it — when he arrived, cloud security and XDR had been acquired and a SIEM was an idea, but there was no plan and perhaps a tenth of the resources, and "ideas are not good enough"; then communicate constantly and block-and-tackle whatever is in the team's way, people, contracts, missing tools.

The 19 acquisitions come with rules that are unusually founder-friendly. He will not buy number three because it is cheap: customers have already found gaps you have not, the leader is still four steps ahead, and all you did is slow a nimble third-place startup and gift the top two more time. Browser-security company Talon and DSPM vendor Dig were filtered that way. You have to sell the founders a better-together story, not a sell-and-dump, because a great product takes four to seven years and you are usually buying them a third of the way through. From day one they are on the team — he comes from a country that was once ruled, and he will not run acquirer-versus-acquired. While finance and legal diligence, the founders get six weeks to build a joint product plan and a joint org chart; if either side hates the result, there is no deal, a rule paid for by the first two or three deals that then spent six months arguing who the boss was. Most often the acquired founder becomes the SVP running the business, and Palo Alto's people work for them. You had the resources and lost. Maybe you can learn a few things.

The lightning round started with cricket. Arora and about ten others, including Goetz — "failed cricketers," in his phrase — bought London Spirit. Sport is the last linear thing in streaming: you watch it live or you already know the score. Cricket is the second-most-watched sport in the world; the IPL is the giant franchise, The Hundred the next bet, in the country that is the home of the game. The buying rule was the same one he uses on startups: if you are going to buy, buy the best. What cricket taught him about leadership is the obvious team-sport lesson. It does not matter how good you are if the other ten people are not; you can have a bad day and still win because ten other people showed up.

On NVIDIA at $118 a share, a $2.9 trillion market cap, 39 times earnings, with earnings growing about 150% year over year — long or short? He does not understand the multiple. He will not trivialize Jensen Huang. Huang took chips built for gaming, saw the compute need, and has been the longest-serving CEO in the game, now wrapping an ecosystem around the silicon. In the history of mankind, Arora said, compute, bandwidth, and memory have never shrunk, and they are not about to start. Whether it is a $3 trillion asset today he does not know; in ten years, possibly more. Asked which CEO he admires most, he refused a single idol who can disappoint, and instead named traits: Elon Musk's creativity and the fact that people will sit in a rocket and a driverless car those teams built; Satya Nadella turning around a company few believed in; Tim Cook following Steve Jobs down the middle; Mark Zuckerberg taking Meta around again.

Which CEO is executing best in AI right now? For all the conversation around Sam Altman, Arora thinks what he has done is amazing. Before ChatGPT, people were not talking about AI in the hallway even though Google, DeepMind, and Microsoft already knew the field. Altman created the impetus for the next technological revolution the way Jobs did with the iPhone, and with a straight face got people to commit on the order of half a trillion dollars of infrastructure. Every Magnificent Seven CEO is now spending more on compute and data centers because nobody wants to be left behind. History will decide the winner. Getting the industry here, Arora said, was already a great job.