Today May No Longer Be the Most Secure Day of Your Life

For years I’ve joked that “today is the most secure your digital life will ever be.”

Tomorrow there will be another dependency, another CVE, another attack technique, another bug nobody has discovered yet.

For decades, cybersecurity has felt like entropy. Every sprint adds features. Every release adds dependencies. Every integration expands the attack surface. Feature budgets get all the love, and security gets bolted on afterward. “You have a 90-day remediation plan for everything your pentest found? Congratulations! You passed the audit.”

I don’t mean that as a knock on SOC 2. It’s the world we’ve built. We celebrate discovering vulnerabilities, promise to fix them over the next quarter, and call that success, while tomorrow’s unknown vulnerabilities pile up behind us. The number of bugs nobody has found yet has always seemed destined to grow faster than anyone could hunt them down.

Over the past few weeks, I’ve started wondering whether that assumption is becoming obsolete.

Three recent results

The first is Capital One releasing VulnHunter, an open-source AI system that analyzes source code the way an attacker would. It starts from entry points and reasons forward about whether exploitation is actually possible, instead of pattern-matching against known vulnerability signatures. After it finds a candidate vulnerability, its “falsification engine” tries to disprove the finding before bothering a human with it. That detail stuck with me, because trying to prove yourself wrong is what researchers do, not scanners.

The second is zkSecurity’s write-up on OpenVM, where their AI auditor surfaced a previously unknown critical soundness bug that became CVE-2026-46669. The team is careful to note that the AI produced a candidate finding rather than a final report, and that humans confirmed exploitability and coordinated the disclosure. But the discovery itself came from the machine, and discovery was supposed to be the part you couldn’t systematize.

The third is Calif.io’s Journey to Root series, which I want to describe carefully, because it’s the least comfortable of the three. This was not an AI autonomously hacking Chrome. The researchers put it plainly: the human is the captain and the AI is the steering wheel. People set the strategy while AI models compressed the grinding parts of exploit development, like tuning heap sprays, tracing data flows, and constructing primitives. When they let the AI run unsupervised, it stalled until a human offered a one-line hint. So the write-up demonstrates leverage, not autonomy. A small team moved through work that traditionally consumes elite specialists for months.

Any one of these is a neat engineering story. Taken together, I think they hint at something bigger.

What if the direction flips?

For decades we’ve assumed software accumulates unknown vulnerabilities faster than humans can discover them. What if AI reverses that equation? What if, for a given codebase, every day held fewer unknown vulnerabilities than the day before, not because developers stopped writing bugs, but because machines got very good at finding them?

If that happens, cybersecurity changes from a losing race against accumulating uncertainty into a race to accumulate understanding.

But before I let myself believe it, I have to deal with the obvious objection, because the Calif.io result cuts both ways.

Attackers get the same tools

If AI multiplies the people who can find and exploit vulnerabilities, it multiplies the attackers too. Anyone reading these papers with dread instead of hope isn’t being paranoid. There is a generation of latent bugs sitting in deployed software right now, and both sides just got faster at flushing them out. The transition could be rough.

Here’s why I remain optimistic anyway: the race doesn’t decide the destination. It only decides the toll.

Every vulnerability eventually leaves the unknown pool through one of two doors. It gets discovered and patched quietly, or it gets exploited in the wild, detected, and patched loudly. A used zero-day, once caught, is no longer a zero-day. Either way, the pool drains. Defenders won’t win every race. Sometimes an exploit gets there first, and that will hurt. But each bug that surfaces, whether by white paper or by breach, leaves the pool for good. The chaos of the transition is a one-time toll rather than a new steady state. And defenders hold the home-field advantage for the long game. They have the source code, the CI pipeline, and the ability to run these tools continuously from the inside, before release, forever, while attackers only get to probe from the outside.

What stewardship decides is which door your application’s bugs exit through, and who pays the toll.

Finding isn’t fixing. But fixing got cheaper too.

There’s a second objection worth taking seriously. If AI only accelerates discovery, we haven’t inverted anything, we’ve just grown a taller backlog. The 90-day remediation plan becomes a 900-item remediation plan. Known-but-unpatched is where attackers feast today, and a flood of new findings could briefly make that worse.

But discovery isn’t the only thing getting compressed. We recently took a Rails 4 app to Rails 8.1 in about ten hours, on what would have been a 100-hour project the old way. VulnHunter reports findings and drafts targeted fixes for human review. The same leverage that’s transforming discovery is transforming remediation: the dependency bumps, the deprecated API migrations, the version-by-version grind that made “we’ll patch it next quarter” the industry’s default posture.

So the loop closes. AI finds the bug, AI drafts the fix, and the human work concentrates where it has always mattered most: deciding what’s a real blocker, reviewing what the machine produced, and exercising staging before anything touches production. The pipeline from find to fix is compressing at both ends, and human judgment is what remains in the middle.

Not every application gets the reprieve

I want to be careful about the scope of this claim, because I argued last month that cheaper building means vastly more software gets built. More code, written faster, much of it by agents and reviewed lightly, means more vulnerabilities created faster too. Across the whole ecosystem, the pool of unknowns may well keep growing.

The inversion is a property of stewarded software, not of the ecosystem as a whole.

An application that is continuously upgraded, audited, and examined by ever-improving AI can have fewer unknowns today than it had yesterday. The unstewarded flood rising around it enjoys no such trend, and it’s the unstewarded software that will pay the exploited-in-the-wild toll during the turbulent years ahead.

The institutions that price that toll won’t sit still, either. I expect the hoops insurance companies make us jump through, and the standards auditors hold us to, to tighten as unpatched vulnerabilities cause real pain out in the wild. Standards have always codified whatever diligence is affordable. When continuously hunting your own bugs cost more than most applications were worth, a 90-day remediation plan really was responsible stewardship. Once AI auditing makes that hunt cheap, the wink I opened this post with stops working, and “we hadn’t found it yet” starts sounding less like bad luck and more like a choice. Stewardship is about to stop being extra credit and start being the standard.

That changes something I’ve believed my whole career. We’ve always discounted older software on uncertainty, not because we knew it was insecure, but because we assumed it hid countless things we didn’t know. If AI continuously converts unknown risk into known, fixed, documented risk, then age matters less than care. A twenty-year-old application under real stewardship doesn’t have to become less trustworthy over time. It can become better understood than it has ever been. We’ve written before about repaired software being more beautiful than pristine software, and AI auditing pushes that idea further: every patched CVE is another gold seam.

One boundary I should draw: none of this touches the human layer. Phishing, social engineering, and the voice-cloning scams that AI keeps making cheaper attack people rather than code, and no falsification engine patches a person. This post is about the software half of the problem. The human half is a post for another day.

The least secure day of the rest of your life

For most of my career, I’ve assumed that software naturally decays, that uncertainty always compounds faster than understanding. For the first time, I’m not sure that’s true anymore.

And if it isn’t, my old joke needs updating. Today may no longer be the most secure day of your digital life.

It may be the least secure day of the rest of it.

That’s the version of the future worth working toward, and stewardship is how you make your way onto the right side of it. If you’ve got an application you’ve been discounting because of everything you don’t know about it, we’d love to talk about what it would take to know.