Matthew Green: It's a Patch Explosion, Not an AI Hacking Wave — and the Hardening Window Keeps Being Missed

On October 22, Johns Hopkins cryptographer Matthew Green posted a flurry of tweets on the topic of "AI accelerating vulnerability discovery," with a core verdict: there is no so-called "AI-driven hacking explosion" underway right now—what's actually happening is an explosion of patching, plus one old-fashioned, low-level blunder unrelated to AI. Sociologist Zeynep Tufekci shares the same view. Green quipped that if this is the new speed of vulnerability discovery, he's actually reassured—everything gets hacked eventually anyway.

Confirmed

• Green's view: the AI danger is real and an attack wave may come in the future, but right now it's a patch explosion, not an attack explosion; Zeynep Tufekci expressed the same judgment.
• Green called for building datasets: for every major vulnerability discovered in the coming months, record whether maintainers ran AI auditing tools such as Mythos or Daybreak, to measure the share of hardening fixes attributable to them and quantify the real effectiveness of AI security tools.
• Green raised another key question: does AI-generated code that heavily depends on specific models have a higher or lower vulnerability rate than human-written code? He noted that no one systematically collects such data, though AI labs should be doing exactly that.
• Green amplified an observation from security researcher joaxcar: once someone finds a vulnerability with AI, reproduction becomes trivially easy—joaxcar spent 48 hours on heap alignment to find the first GitLab RCE with Codex, while others with full information reproduced it in about 1 hour, showing the attack barrier collapsing.
• Green debated security researchers including HackingLZ over whether AI significantly lowers the barrier to lethal cyberattacks: the other side argued that groups truly intent on killing via cyber means are limited and fear retaliation, and nation-state attackers already have other avenues.

Why it matters

• The discussion pulls the focus back from panic-driven narratives to measurable empirical questions: whether AI security tools actually reduce vulnerabilities, and whether AI-generated code is less secure—both currently lack systematic data.
• The asymmetry that vulnerabilities are "hard to find first, easy to reproduce" means the attack surface expands rapidly once a flaw is exposed, making patch speed the critical line of defense.

2026-10-22 ~ 2026-10-24 · 12 related posts

• Matthew Green debates AI lowering the bar for lethal cyberattacks, citing jailbroken GLM 6 — matthew_d_green · 2026-10-22
• Zeynep Tufekci pushes back: we see a patching explosion, not an AI hacking explosion — zeynep · 2026-10-22
• Researcher: AI cut GitLab RCE reproduction from 48 hours to 1, collapsing exploit lead time — matthew_d_green · 2026-10-22
• [source] Cryptographer Matthew Green jokes AI's bug-finding speed means 'it'll all be over in six months' — matthew_d_green · 2026-10-22
• Matthew Green asks: are bugs found with AI auditors like Mythos and Daybreak being tracked? — matthew_d_green · 2026-10-22
• Cryptographer: AI labs should track whether AI security tools actually catch real vulnerabilities — matthew_d_green · 2026-10-22
• Cryptographer asks: is AI-generated code more or less likely to have vulnerabilities? — matthew_d_green · 2026-10-22
• [source] Security researcher: no AI hacking explosion yet, just a patching explosion — matthew_d_green · 2026-10-22
• Vulnerability bonanza, yet no crypto black swan yet — and that's impressive — Kyrannio · 2026-10-23
• Security researcher: php2shell is no discontinuity, but now is the window to harden everything — joshua_saxe · 2026-10-23
• [source] Cryptographer Matthew Green: the window to harden everything against AI attacks has slipped — matthew_d_green · 2026-10-24
• AI offense will move faster than defense, warns cryptographer Matthew Green — matthew_d_green · 2026-10-24