Because software code is a language, LLMs are becoming superhuman coders. This makes them incredibly effective at finding system vulnerabilities for hacking (offense). However, this exact same capability makes them equally powerful for identifying and fixing those flaws (defense), leading to a rapid escalation in cybersecurity.

AI models are highly effective at finding security flaws faster than humans. While their defensive capabilities (e.g., auto-patching) are unreliable due to false positives, their offensive power creates urgency for enterprises to fix vulnerabilities, ultimately strengthening the cybersecurity ecosystem.

The same AI technology amplifying cyber threats can also generate highly secure, formally verified code. This presents a historic opportunity for a society-wide effort to replace vulnerable legacy software in critical infrastructure, leading to a durable reduction in cyber risk. The main challenge is creating the motivation for this massive undertaking.

Anthropic's new AI model, Mythos, is so effective at finding and chaining software exploits that it's being treated as a cyberweapon. Its public release is being withheld; instead, it's being used defensively with select partners to harden critical digital infrastructure, signifying a major shift in AI deployment strategy.

Advanced AI cyber tools like Anthropic's Mythos don't create new vulnerabilities; they excel at discovering existing, dormant bugs in human-written code. Their proliferation will catalyze a one-time, industry-wide upgrade cycle, ultimately hardening global infrastructure and leading to a more secure equilibrium between AI-powered offense and defense.

The greatest cybersecurity risk is not powerful AI, but an imbalance where attackers possess capabilities that defenders lack. Open-sourcing models ensures defensive tools can evolve alongside offensive ones, creating a more resilient ecosystem. It empowers defenders to react faster and make the entire system safer for everyone.

The long-term trajectory for AI in cybersecurity might heavily favor defenders. If AI-powered vulnerability scanners become powerful enough to be integrated into coding environments, they could prevent insecure code from ever being deployed, creating a "defense-dominant" world.

A government policy that prevents US AI models from finding security bugs would be counterproductive. To write secure code, an AI must first understand what a vulnerability looks like. Such a ban would force American developers to rely on uncensored foreign models and would paradoxically result in the creation of less secure American software.

While AI models excel at identifying security vulnerabilities, the next major innovation lies in automatic remediation. The "holy grail" for cybersecurity startups is developing AI systems that can instantly patch and fix identified threats, moving beyond simple detection to proactive, zero-day defense.