The same AI technology amplifying cyber threats can also generate highly secure, formally verified code. This presents a historic opportunity for a society-wide effort to replace vulnerable legacy software in critical infrastructure, leading to a durable reduction in cyber risk. The main challenge is creating the motivation for this massive undertaking.

While AI can be used to create exploits, its greater impact is on security. AI tools empower a vastly larger pool of contributors to scrutinize open codebases, identify flaws, and submit patches, strengthening the ecosystem faster than is possible in a closed environment.

Advanced AI cyber tools like Anthropic's Mythos don't create new vulnerabilities; they excel at discovering existing, dormant bugs in human-written code. Their proliferation will catalyze a one-time, industry-wide upgrade cycle, ultimately hardening global infrastructure and leading to a more secure equilibrium between AI-powered offense and defense.

The cybersecurity landscape is now a direct competition between automated AI systems. Attackers use AI to scale personalized attacks, while defenders must deploy their own AI stacks that leverage internal data access to monitor, self-attack, and patch vulnerabilities in real-time.

The risk of malicious actors using powerful AI decision tools is significant. The most effective countermeasure is not to restrict the technology, but to ensure it is widely and equitably distributed. This prevents any single group from gaining a dangerous strategic advantage over others.

Instead of releasing new AI models to everyone simultaneously, a better strategy is providing early, privileged access to trusted defenders like vaccine developers. This allows them to build countermeasures and create a 'defensive uplift' advantage before malicious actors can exploit new capabilities.

The long-term trajectory for AI in cybersecurity might heavily favor defenders. If AI-powered vulnerability scanners become powerful enough to be integrated into coding environments, they could prevent insecure code from ever being deployed, creating a "defense-dominant" world.

The old security adage was to be better than your neighbor. AI attackers, however, will be numerous and automated, meaning companies can't just be slightly more secure than peers; they need robust defenses against a swarm of simultaneous threats.

While making powerful AI open-source creates risks from rogue actors, it is preferable to centralized control by a single entity. Widespread access acts as a deterrent based on mutually assured destruction, preventing any one group from using AI as a tool for absolute power.