I think this marks the beginning of the golden age. Investments in automated agent driven security scans on all software is coming to every business. Software and infrastructure will become more secure than ever before.

I also hope that we come out in a golden age, but we are very much in for a rough few months/years where all the low hanging fruit is being picked up until we end up with much more hardened systems.

Why would it be more secure if there is even more investment in automated agent driven insecure code generation that can outpace any scan capacity?

If catching "all" security issues becomes feasible then the balance tilts in favor of the projects vs the attackers.

Big malicious entities always had more investments in this than random open source projects.

Since you need an unrealistic if, I presume you agree that the balance doesn't shift?

The pig age full speed ahead

This has been going on for months actually with no end in sight.

Maybe I'm not enough in the weeds to see it as much, but the last few months seem to have been a much slower trickle of "how did we not catch this" exploits, while they are now appearing with much more sophisticated (though still usable in practice) exploit chains on much larger target codebases.

The last few months seem to have been a lot more imunder control with also the frontier labs more warning of "what happens when Mythos-class model get in the hands of everyone" than that actually becoming reality. Now, it appears to be actuually turning into reality.

It depends on the net rate of new bugs being made vs the bugs discovered and fixed. Hopefully AI can find bugs faster than new ones are being created.

The problem is fixing the bug and not only fixing the code, but applying the fix in production in a timely manner and without interrupting the business.

Seems like we are paying down decades of technical debt created by very fast and loose programming.

> the single worst security news day ever

I'd say, the single worst security news day for now

Attack Tokens versus Defense Tokens has already been the norm for the past 2 years. AI is just that good at this game.

It's over. Cybersecurity is now Yugioh, where the lifepoints is your token budget.

Programs now need to be perfect. We'll need everything that can even theoretically touch a public network to be formally verified soon

Did you go to sleep in 2015 and then wake up just now in 2026?

That's where we will end up, but the in between time is the worst time ever for trying to secure an internet connected computer.

> At the end of this software is going to be a lot more secure.

Can I get that in writing?

As we speak more slop is added to the pile, far more than can reasonably be reviewed and a lot of that code will be insecure.

It's ok, we'll just point more LLMs at the new code and the problem will fix itself. In the mean time can we unplug the ethernet cable from the nuke silos for a while?

Priorities... you are right.

Code does not need to be reviewed to be secure. [^]

It needs to be designed to be secure.

[^] of course I'm hyperbolic here, it does still need to be reviewed – I just mean, review doesn't matter as much as choosing a secure design, where certain bugs just can not or will not happen.

Code review is just one of many filters. 'Secure designs' are as secure as the designer, and no designer is perfect. Implementations are as secure as the implementors and processes are not perfect either. You need these and many other layers in your filter to be secure for some arbitrary level of security where the final result is roughly proportional to how much money you are willing to expend.

Buckle up