No robots in the gym, with Keith Hoodlet

This week on the Chasing Entropy Podcast, host Dave Lewis sits down with Keith Hoodlet, Director of Security Research at 1Password and leader of the newly formed Off-by-1 Labs. Keith’s mission? “To throw stones at glass houses, not to hear the crash necessarily, but to help people build better and more secure houses.”

A villain-turned-hero origin story

As Keith puts it, “I’ve always been really focused on skill acquisition over formal titling or formalized skillsets in many ways.” After all, he got his start as a self-proclaimed “unpaid punk on the internet, messing with video games, mostly.” 

As a teen, Keith would spoof other Diablo players by using a trial key from the back of a CD case, and taught himself Visual Basic so he could spam StarCraft opponents. He realized early on that he was “pretty good at the whole computer thing.” 

That’s why he decided to major in psychology – it was something he couldn’t do. He wanted to understand people better. 

Graduating in the midst of the housing market crash had him working odd jobs for several years. He returned to school for computer science, only to drop out when he received a job offer. From there, he built his career gradually through roles at Bugcrowd, Thermo Fisher Scientific, GitHub, Trail of Bits, and now 1Password. 

It may have been a nonlinear career path, but there have been plenty of highlights throughout that journey, including winning the U.S. Department of Defense's 2024 bias bounty program; it was one of the first times an organization paid external researchers to prove an AI system was biased and unfit for its intended use. 

Keith continues to make use of the varied skills he built over those years. For instance, his psychology background may not show up in threat models, but it shows up daily in his leadership: “I start from a place of approaching the other party that I’m interacting with as first a human being… and try to build that human-level connection that really goes a long way toward improving security outcomes.”

Advice for his younger self

Keith shared the advice he'd give his 18-year-old self in an era where AI threatens entry-level white-collar work:

• Start a blog before anything else: Where video content’s success tends to be short-lived, written content compounds in value over time and records your ideas and principles as they evolve. In fact, Keith shared his own blog posts on leadership during his 1Password interview loop.

• Think hard about the college question: Keith was careful to note college still makes sense for many, but at today's costs, people should be thoughtful about why and when they pursue a degree.

• Reading is weightlifting for your brain: Whether you start with newsletters or novels, reading widely lets humans make intuitive leaps, and sitting down to read cultivates patience and critical thinking. Keith argues that those skills remain a genuine advantage over large language models.

Overall, Keith emphasized the importance of building a personal brand and body of work that make you credible to employers.

No robots in the gym

Today, there’s an apparent tension in Keith’s work: he's an AI security researcher who also warns that prolonged AI use can erode critical thinking. 

Keith’s answer borrows a phrase from his friend Daniel Miessler: “no robots in the gym.” 

Essentially, don’t use AI for any skills that you want to cultivate. For Keith, that means writing, reading primary sources, and thinking critically. For skills he has less interest in developing (like building yet another TypeScript web app), he uses AI – and then interrogates its output.

His practical tip for validating AI output was to ask a question that also serves as a forcing function for critical thinking: LLMs produce statistically likely answers, so write what the model gives you on a whiteboard, draw a box around it, and ask, "what's not in this box?"

Building a career? Start by doing things

For security leaders and newcomers alike, Keith's advice converged on one theme: don’t wait for permission to do things.

As he put it: “The technology in security is always moving faster than we can keep up with. There’s only so much time in the day that you have. So try a bunch of different things. Learn a bunch of different skills. Develop a lot of different ideas… That is the surefire way to build a foundation for your career that will continue to thrive amidst all of the changes happening with AI.”

Listen to the full conversation with Dave Lewis and Keith Hoodlet on Chasing Entropy, and see what ideas or skills it might inspire you to pursue.