Though defenders are being given a head start, they face a disadvantage of another sort. Attackers only have to succeed once. “But, as defenders, we need to make sure that every single vulnerability is covered,” Schwartz says.
AI is helping defenders find those vulnerabilities first. Previously, testing suspected bugs could take weeks, forcing researchers to prioritize which were most promising. But now AI agents allow researchers to test many ideas at once, Tzadik says. “It’s months of traditional research condensed to, like, days—couple hours to days, really.”
But even with AI, the process is labor intensive. After the agent helped Wiz uncover the PHP vulnerability, it still couldn’t describe how the bug worked, Tzadik says. Its explanations were “just slop.” He and colleagues spent days untangling the cause of a bug and eventually reproducing it.
Cost is another constraint. Joshua Saxe, Meta’s former AI security tech lead, who left in February to co-found Abundance Security says he’s working with an organization that has spent roughly $1 million using Anthropic’s Mythos to identify bugs, adding that more bugs remain.