This is a serious shift for global cyber. As AI intelligence and harnesses go up, the ease of discovery goes up — and the incentive anyone needs to go looking drops sharply.
01They were always there
Every vulnerability a better model finds in existing code was sitting there last year, and the year before. The model didn't plant them. What changed is the cost of looking.
When finding a bug took weeks of expert time, almost no one bothered unless the payoff was huge. Drop that cost to an afternoon of agent time and the trade changes for everything at once. The same bugs, suddenly worth finding — by anyone.
Surfacing isn't the discovery of new flaws. It's a debt coming due.
02Many eyes, corrected
"Given enough eyeballs, all bugs are shallow." The line assumed open code gets looked at because it can be. But being able to look and actually looking are two different things.
Looking costs effort, and people spend effort when something pays them back. So the eyeballs were mostly closed — not from laziness, but because reading someone else's code for free is a bad trade.
Better models change the trade. When looking is much cheaper, the incentive needed falls steeply, the eyeballs finally open, and the old promise comes true. For defenders and attackers alike.
03The race this starts
The same rising AI lowers the effort for everyone. Defenders and attackers reach toward the same ceiling: more of the debt, surfaced faster, at the same time.
The contest was never about who could look. It's about who reaches a given bug first, and whether you spend the cheap effort now or wait for someone else to spend it on you.
The water is rising on everyone. Better to be the one holding the light.