Because software code is a language, LLMs are becoming superhuman coders. This makes them incredibly effective at finding system vulnerabilities for hacking (offense). However, this exact same capability makes them equally powerful for identifying and fixing those flaws (defense), leading to a rapid escalation in cybersecurity.

The current security landscape presents a paradox. While AI creates a new, complex threat surface, it also provides defenders with unprecedented tools. For example, building a software taxonomy, a task that once took years and hundreds of researchers, can now be done in weeks using AI agents.

While AI can be used to create exploits, its greater impact is on security. AI tools empower a vastly larger pool of contributors to scrutinize open codebases, identify flaws, and submit patches, strengthening the ecosystem faster than is possible in a closed environment.

Advanced AI cyber tools like Anthropic's Mythos don't create new vulnerabilities; they excel at discovering existing, dormant bugs in human-written code. Their proliferation will catalyze a one-time, industry-wide upgrade cycle, ultimately hardening global infrastructure and leading to a more secure equilibrium between AI-powered offense and defense.

While AI enhances offensive capabilities, its greatest potential may be defensive. Easterly posits an optimistic future where AI models become so adept at finding and fixing vulnerabilities in code that they effectively 'end cybersecurity as we know it,' leading to a new era of inherently secure software, much like modern cars are inherently safer.

AI models like Claude are proving to be powerful tools for cybersecurity defenders, not just attackers. Researchers used AI to quickly discover a critical, 25-year-old vulnerability in DNA evidence database software, highlighting AI's potential to audit and secure aging, high-stakes infrastructure that was previously too costly to overhaul.

The same AI models that can exploit system vulnerabilities are also the most effective tools for identifying and fixing those weaknesses. This duality creates a policy paradox: restricting the technology to prevent its misuse as a weapon also prevents its use as a defensive shield, leaving systems vulnerable.

An AI model capable of executing complex cyberattacks is equally capable of identifying and fixing those same vulnerabilities. A government like China's will likely first deploy the model for defense—patching critical systems—before any public or commercial release, thus mitigating risk.

The long-term trajectory for AI in cybersecurity might heavily favor defenders. If AI-powered vulnerability scanners become powerful enough to be integrated into coding environments, they could prevent insecure code from ever being deployed, creating a "defense-dominant" world.