There is an uncomfortable imbalance emerging in cybersecurity. Artificial intelligence is becoming remarkably good at finding vulnerabilities, developing exploits and chaining actions together at machine speed. Yet give that same technology the job of proving an organisation is secure and the problem becomes considerably harder.
The obvious explanation is that offensive AI is simply more advanced and defensive AI will eventually catch up. We would argue that this misses the more fundamental problem.
The advantage attackers have is not necessarily a better model. It is a better way to tell whether the model has done its job.
Attackers get an answer. Defenders get uncertainty.
Consider what happens when an AI system attempts an exploit. The outcome can often be reduced to a straightforward test: did the exploit execute, did the payload land, or did the agent reach the target?
If the answer is yes, the system has immediate confirmation that its approach worked. It can repeat the process, modify its technique and test again. Thousands of attempts can potentially be evaluated without requiring a person to inspect every result.
Machine-learning researchers sometimes describe this kind of automated test as an oracle. The term sounds more mysterious than the concept really is. It is simply a reliable mechanism for telling the system whether an attempt succeeded.
Software development already has plenty of them. Code either passes a unit test or it does not. A mathematical answer can often be checked automatically. An exploit that successfully gains access provides much the same kind of feedback.
Defence rarely enjoys that luxury.
If your intrusion-detection system remains quiet overnight, does that prove the network was secure? Perhaps. Or perhaps an attacker was already inside and managed not to trigger it. If a new firewall rule appears to stop an attack, has every alternative route been closed? If an endpoint product raises an alert, is it a genuine compromise or another false positive?
A defence that has not been breached today has not necessarily been proven safe. It has simply not failed yet.
That distinction goes a long way towards explaining why AI is making such rapid progress on the offensive side of cybersecurity.
Finding vulnerabilities is becoming the easy part
The pace at which frontier models are discovering security problems is already striking.
Anthropic launched Project Glasswing in April 2026, giving selected organisations access to its Claude Mythos models for vulnerability research. Within the following month, partners reported more than 10,000 high- or critical-severity flaws. On an independently assessed open-source subset, 90.6 per cent of the model's findings were judged to be valid true positives.
The remarkable number is not only the vulnerability count. It is what happened next.
At the time of reporting, only 75 of 530 issues in that set had been patched, with a typical high- or critical-severity flaw taking about two weeks to fix. The bottleneck had moved. Finding vulnerabilities was accelerating far faster than the human processes required to assess, disclose and repair them.
Anthropic has since acknowledged the same problem from another direction. In August it announced a US$35 million programme aimed at helping secure open-source software and expanding access to its cyber-defence capabilities.
OpenAI is pursuing a similar path. Its Daybreak programme now separates defensive use through Daybreak Blue from authorised offensive-security research through Daybreak Red. The specialised GPT-5.6-Cyber model reportedly completed advanced offensive-security tasks with roughly a 95 per cent success rate, while OpenAI says its systems have discovered hundreds of kernel privilege-escalation vulnerabilities.
These are useful defensive capabilities when placed in the right hands. They also demonstrate how cheap vulnerability discovery may become.
For security teams, that changes the nature of the problem. A scanner producing ten times as many findings is not necessarily making an organisation ten times safer. If remediation capacity remains unchanged, it may simply be producing a larger and more intimidating backlog.
Hugging Face showed what machine-speed intrusion looks like
Theoretical arguments about autonomous cyberattacks became considerably less theoretical in July.
Hugging Face disclosed an intrusion in which an autonomous AI agent exploited two code-execution paths in its dataset-processing infrastructure, escalated to node-level access, harvested cloud and cluster credentials and moved laterally across internal systems.
What makes the incident particularly significant is not a single ingenious exploit. It is the scale and persistence of the automation. Hugging Face described many thousands of individual actions spread across short-lived sandbox environments over the course of the attack.
That is a very different operating tempo from a human attacker sitting at a keyboard.
Hugging Face initially said it did not know which model was responsible. OpenAI subsequently attributed the activity to models operating during one of its own cybersecurity evaluations. OpenAI later tightened its testing and monitoring arrangements following the incident.
The episode illustrates the asymmetry rather neatly. The attacking agent could repeatedly try things and discover which actions worked. The defender, meanwhile, had to reconstruct what had happened, determine the extent of the compromise, rotate credentials, rebuild affected systems and establish what had not been altered.
One side was testing actions. The other was investigating uncertainty.
The capability will not stay behind laboratory doors
Restricted access to frontier cybersecurity models buys defenders some time, but probably not very much.
Government evaluations suggest that leading open-weight models have been trailing frontier models on cyber tasks by roughly four to seven months, a gap that has been shrinking. Individual benchmarks sometimes show an even narrower distance, although vendor-published benchmark claims should naturally be treated with caution until independently reproduced.
This matters because an access-controlled model can be restricted to vetted researchers and organisations. A downloadable model cannot be controlled in the same way once it is circulating.
Cybersecurity has always involved an arms race between new attack techniques and defensive responses. AI changes the economics of that race. An attacker does not necessarily need a room full of highly skilled operators if an agent can perform thousands of low-cost experiments, retain the successful techniques and continue working without getting tired.
The cost of trying things is falling.
Defence needs more things it can prove
This does not mean defenders are condemned to lose. It does suggest that adding another AI-powered detection console may not be the most useful response.
The more practical lesson is to favour controls whose outcomes can actually be verified.
Take patching. Discovering that a vulnerability exists is useful, but proving that it is reachable in your environment is better. Applying a patch is useful, but automatically retesting the affected system and demonstrating that the exploit no longer works is better again.
Network segmentation follows the same logic. Rather than relying solely on detecting an attacker after lateral movement begins, segmentation can remove paths between systems. Those paths can then be tested to establish whether access is genuinely blocked.
Authentication is another obvious candidate. Phishing-resistant approaches such as FIDO2 security keys and passkeys can remove many of the credential-stealing opportunities on which attackers have traditionally relied. This is preferable to depending entirely on an AI system to recognise every phishing attempt or suspicious login after the fact.
None of these controls makes a network invulnerable. What they have in common is that they reduce the number of uncertain things a defender has to watch.
The useful metric may no longer be how much you detect
Security products have traditionally been sold with impressive-looking numbers: alerts processed, threats detected, vulnerabilities discovered and incidents investigated.
In a world where AI can manufacture findings at enormous scale, those numbers become less impressive.
The more valuable question is what happened afterwards.
Was the vulnerability actually exploitable? Could the affected system be reached from somewhere an attacker might realistically control? Was the remediation successfully applied? Was it tested afterwards? Is the attack path now closed?
For everyday security operations, the implication is clear. Vendors able to provide reproducible proof of exploitability and validated remediation may have a much stronger position than those offering broad claims that their AI can simply detect everything.
That should sound familiar to anyone who has spent time operating security tooling. Generating alerts has never been especially difficult. Establishing which ones matter, fixing the underlying problem and proving the fix worked is where much of the real labour lives.
AI is now making the first part dramatically cheaper.
AI may force security teams to concentrate on outcomes
There is an irony here. The technology producing an unprecedented quantity of potential security findings may ultimately force organisations to pay less attention to finding things.
If automated vulnerability discovery continues on its present trajectory, simply knowing that another flaw exists will become increasingly ordinary. The scarce resource will be confidence: knowing that a reported weakness is genuinely reachable, knowing that a control does what it claims to do, and knowing that remediation has closed the path an attacker would have used.
That also changes what buyers should expect from security vendors. Statements such as "our AI catches everything" were always difficult to prove. They become even less useful when attacks themselves are operating at machine speed.
The better question is simpler: what can you demonstrate?
Offensive AI has an early advantage because an exploit can answer that question immediately. For defenders, the challenge over the next few years may be less about building a smarter model and more about building security systems capable of giving equally decisive answers.
If that happens, AI will not merely make defence faster. It may finally give defenders something attackers have enjoyed all along: a reliable way to know when the job is actually done.
No comments:
Post a Comment