I want to hear what @daveaitel @chrisrohlf @halvarflake @dyn___ @WHITEHACKSEC @S1r1u5_ and others have to say. Just so they can dunk on my stupid ideas my mind goes to runtime protections made newly possible by AI program analysis and that can be implemented by the operating system providers. For example if AI can get us a research breakthrough around lifting out the intended control flow graph of a binary program perhaps we can shim programs onto better control flow integrity protections. If this can be done cheaply, an OS can enforce that any new binary program be run through this reverse engineering flow and then placed onto the improved control flow integrity system. The generalization of this idea is that if we can get breakthroughs around inferring the programmer intent in binary programs we can more tightly bound and enforce on their dynamic behaviors and obviate - hopefully - a double digit percentage of exploit paths. Could apply to what filesystem, network, memory and process privileges we give programs, for example. Validation from Astra on the CFI thing: "Under the strong version of your premise—AI recovers a near-exact intended CFG, ~15–25% of currently exploitable running programs worldwide become effectively unexploitable by their presently available attack surface. I'd use ~20% as the point estimate. That's notably lower than the fraction of individual exploits you'd break. I think you'd break something like 35–55% of practical native-code exploitation paths, and perhaps 50–70% of classic control-flow-hijacking exploits."