The core open-source belief that enough human experts will find all bugs is invalidated by AI discovering decades-old vulnerabilities in widely scrutinized code. This proves that high-level machine analysis is now essential for security, as human review alone is insufficient.

The same AI technology amplifying cyber threats can also generate highly secure, formally verified code. This presents a historic opportunity for a society-wide effort to replace vulnerable legacy software in critical infrastructure, leading to a durable reduction in cyber risk. The main challenge is creating the motivation for this massive undertaking.

Advanced AI cyber tools like Anthropic's Mythos don't create new vulnerabilities; they excel at discovering existing, dormant bugs in human-written code. Their proliferation will catalyze a one-time, industry-wide upgrade cycle, ultimately hardening global infrastructure and leading to a more secure equilibrium between AI-powered offense and defense.

Anthropic's AI found thousands of vulnerabilities in supposedly well-vetted open-source code. Because this code is widely copied and embedded in countless enterprise systems, these flaws represent a massive, previously unknown attack surface across global digital infrastructure.

The long-term trajectory for AI in cybersecurity might heavily favor defenders. If AI-powered vulnerability scanners become powerful enough to be integrated into coding environments, they could prevent insecure code from ever being deployed, creating a "defense-dominant" world.

While AI models excel at identifying security vulnerabilities, the next major innovation lies in automatic remediation. The "holy grail" for cybersecurity startups is developing AI systems that can instantly patch and fix identified threats, moving beyond simple detection to proactive, zero-day defense.

While AI will increase cyber risk by enabling faster vulnerability scanning and generating potentially insecure code, it will also be the solution. AI agents will be needed to review code and defend systems, creating a massive new market for "agentic security" companies.

AI models are better at finding bad code than writing good code. This capability will rapidly uncover vulnerabilities in open-source, custom, and vendor software that would have otherwise taken 10 years to find. This creates an urgent, large-scale need for patching across all industries.

The traditional cybersecurity model of humans finding and patching vulnerabilities cannot keep pace with AI that discovers thousands of exploits in hours. This fundamental mismatch in speed and scale will require a complete overhaul of how software security is managed.