AI coding agents will drastically alter both the practice and the economics of exploit development, automating the discovery of zero-day vulnerabilities
For the last two years, technologists have ominously predicted that AI coding agents will be responsible for a deluge of security vulnerabilities.
sockpuppet.orgThomas H. Ptacek
Context & Ripple Effects
The story extends recent coverage that coding agents can complete more complex work with little oversight, a capability shift that makes autonomous software work relevant to security research as well as application development.
If coding agents can automate zero-day discovery, the time and specialist effort required to find exploitable flaws could fall, changing the economics of exploit development.
Security teams would face a more automated adversarial workflow while gaining access to similar capabilities for vulnerability discovery, validation, and remediation.
Second-order effects
Software vendors and security-service providers would be pressured to shorten vulnerability-testing and patching cycles as discovery becomes less dependent on scarce expert labor.
The value of agent-enabled security tools would increasingly rest on reliability, guardrails, and integration into remediation workflows—not merely their ability to identify potential flaws.
Third-order effects
If offensive and defensive agents improve in parallel, cybersecurity could shift toward continuous machine-speed discovery and response rather than periodic human-led testing.
The durable fault line may become access and operational discipline: organizations able to deploy agents safely in their code and remediation pipelines could gain an advantage, while misuse risk rises alongside capability.
The trend: This is part of the broader industrialization of AI agents, in which increasingly autonomous coding systems compress the cost and cycle time of specialized digital work—including security research.
Great post here mirroring some of my thoughts on the future of exploit development. I think @tqbf is absolutely right here. The vast majority of bugs are pattern matching, and having enough patience to find them while having a broad understanding of the fundamental technologies. …
From Carlini's talk at Unprompted a few weeks ago — I wish I'd remembered this detail for the post — here he is, demonstrating Claude Code finding a blind SQLI in Ghost, and then writing a fully-functioning exploit for it. https://www.youtube.com/...
Cyberattacks and vulnerability research is in for a wild run. “successful exploit developers won't carefully pick where to aim. They'll just aim at everything. Operating systems. Databases. Routers. Printers. These kinds of targets run everywhere” https://sockpuppet.org/... [imag…
Another veteran computer security research — Thomas Ptacek — says we're currently in middle of the Computer Security AIpocalypse: https://sockpuppet.org/... [image]
This is (a) extremely true and (b) not just limited to software security. Most of CS is ~10% insight, ~90% jigsaw puzzle. The solver doesn't care about the domain, although it does perform better in the hands of a sophisticated user. [image]
Thomas on LLMs vis software security, or, the thing that has been theorized for years is now, in the judgement of local domain experts, actually happening.
@tqbf “Second, we've been shielded from exploits not only by soundly engineered countermeasures but also by a scarcity of elite attention.” Yes, thank you! As I wrote last year: https://www.lesswrong.com/... [image]
Just finished reading @tqbf's highly insightful post on the future of vulnerability research. For far too long, software was veiled by a form of security-by-obscurity — namely, a dearth of security researchers (and attention cycles) for identifying issues. AI just pierced that
come for the cogent top-line point, stay for the fun '90s hacker history, marvel along the way at the moment where Thomas seems to imply that “doodads” are a kind of internal organ. Also if you don't have direct experience of LLM coding tools as of today, this is the kind of thi…
“Substantial amounts of high-impact vulnerability research (maybe even most of it) will happen simply by pointing an agent at a source tree and typing “find me zero days”. — I think this outcome is locked in. sockpuppet.org/blog/2026/03...
I think the recent iOS exploit kit leaks are a hint of what's to come. I'm less worried about 0-days (since LLMs benefit attackers and defenders roughly symmetrically) and more worried about ubiquitous exploits for n-days.
This is a great article on vulnerability research in the (coming) age of AI, by Thomas Ptacek. It mostly focuses on the fact that machines will soon supplant human vulnerability researchers. That's sad! But my question is: do we get safer, or do we get less safe? sockpuppet.or…