The world is finally seeing the nightmares of what happens when you don't take security seriously for decades. Everyone is getting hacked here and there; it has become a very common saying among security folks that anything that can be hacked will be hacked.
You can argue that the volume of these exploits are higher because of more capable models, however, the reality is they're higher because the vulnerabilities always already existed there, nobody just cared to look. Now that these agents essentially have infinite resources, they're poking in every hole they can find.
Security review of code has always depended on sacred human judgment. AppSec teams are small relative to engineering teams (100 developers to 1 AppSec practitioner)[1], and they already review only a fraction of what gets shipped. It is literally quite impossible to do this on a large scale now.
Claude Code already accounts for roughly 4% of public GitHub commits, and at the current growth rate that could cross 20% of daily commit volume by the end of 2026.[2]
As 100 engineers have each started to produce exponentially more code, the old model of human security review has become irrelevant, adding on top of the fact that it never worked.
Solving Vulnerability Research
Vulnerability research is a subdomain of cyber security, which concerns the process of reading code, or reverse engineering code of software in order to find security issues which can later be exploited.
If you look at vulnerability research as a problem to be solved, there are two phases to it. Discovery and exploitation.
Exploitation is a verifiable problem, as it requires you to write code in order to break into a system after discovering something. However, the former is usually not, the discovery process requires multiple bits of creativity, expert domain knowledge and many unquantifiable features.
Figuring out what causes these models to be good at vulnerability research and then training them specifically on different RL environments, methods of training, gathering data, etc. will require a lot of effort and experimentation. However, this is exactly what is needed.
Specifically on this research side, if we look at the problem of vulnerability discovery, it resembles the order of AlphaGeometry, where there are axioms and bounds clearly defined by the code itself. Code is a transparent entity, it says everything about itself. However, due to things like rice's theorem, we can't statically determine everything.
Using methods from program analysis, we could extract these and train the model into the discovery phase very well. This is one of the many experimental ideas we have. There are breakthroughs to be made to make this a reality.
We will need to experiment a lot, it will essentially take a complete lab-like effort to figure out what is the right thing to do here. This is the right time to do it, we argue that is the only time to do it.