Philippe Lemoine(@phl43):Yes, it's not clear to me why, once models reach a certain level of capabilities, we can't just use them to screen every software/update and they'll literally plug every hole, leaving nothing to be exploited. As far as I can tell, for that not to be true, you have to assume that certain vulnerabilities are essential to ensure functionality. I'm sure one could find some cases where that's true, but I expect they will be exceptions. This is why I'm inclined to think that, in the long run equilibrium, to the extent that AI will favor offense, it won't be by finding vulnerabilities in code but rather by improving the ability to exploit human failures and bottlenecks.

2026.10.23 15:05

Yes, it's not clear to me why, once models reach a certain level of capabilities, we can't just use them to screen every software/update and they'll literally plug every hole, leaving nothing to be exploited. As far as I can tell, for that not to be true, you have to assume that certain vulnerabilities are essential to ensure functionality. I'm sure one could find some cases where that's true, but I expect they will be exceptions. This is why I'm inclined to think that, in the long run equilibrium, to the extent that AI will favor offense, it won't be by finding vulnerabilities in code but rather by improving the ability to exploit human failures and bottlenecks.