From Fleet to Firmware: Bringing AI-Native Security to Open Hardware with Project Equilibrium presented by Google#

Andres Lagar-Cavilla (Google)

• Why: AI turned on the systems that run AI — a genuinely novel direction: autonomous, continuous security for open-source firmware that outpaces what periodic audits and static scanning can do as frontier models accelerate vulnerability discovery.
• What: Google's Project Equilibrium, an AI-native security architecture pairing live, repo-colocated threat models with autonomous pre-submit scanning and automated patching — catching deep bugs and cutting false positives before merge — plus a path to extend the workflow from fleets to bare-metal firmware via open security cookbooks (from abstract only).
• How: Threat models live next to the code they describe; autonomous pre-submit analysis and patching run against the millions of lines of low-level code in OpenBMC, Caliptra, CXL, and NVMe.
• Where applicable: Open-hardware ecosystem broadly (cookbooks are explicitly meant as a shared baseline); currently a Google internal capability being externalized, so treat maturity accordingly — but for anyone whose supply chain includes open firmware, this is where the field is heading.