Debate over AI and Code Security: Researchers Warn AI Agents Are Collapsing Prosaic Cybersecurity

Around the questions of "is AI-written code riddled with vulnerabilities" and the so-called "cyberpocalypse," a chain of discussions unfolded on X on October 22 among researchers and practitioners, with views escalating from optimistic to cautionary.

Confirmed

• tszzl pushed back on concerns that AI code is full of security holes, arguing that most new code in the future will be written by models like fable/astra, and therefore won't be as bug-ridden as human-written code.
• S1r1u5 relayed the view of Anthropic's Chris Rohlf: the discussion underestimates what models can do—beyond rewriting code and hunting bugs, they can modernize code (e.g., upgrading C++03 to C++23), shrink the attack surface, reduce cyclomatic complexity, cut down dependencies, and use those results to train models that produce more secure code (with certain caveats).
• davidmanheim had reservations about both sides: he agreed with Rohlf that much can be done, and with S1r1u5 that it still isn't enough—because what both attackers and defenders can do is enormous, attackers will always find some vulnerabilities before defenders, and the volume of code is staggering.
• davidmanheim laid out two layers of the "cyberpocalypse" debate: the first enjoys broad consensus—traditional (prosaic) cybersecurity is already collapsing due to the rise of AI agents; the second remains contested—whether attackers will dominate the endgame.

Unconfirmed

• The final shape of the offense-defense game: whether attackers will dominate the endgame remains unsettled among discussants.

Why it matters

• This discussion moved the "AI code security" debate beyond a simple count of vulnerabilities to a structural judgment on whether the entire cybersecurity framework is sustainable: if agents skew offense-defense costs and attackers keep winning the race, current defensive paradigms may need to be rebuilt—while AI's capacity for code modernization and security hardening is the hedge the optimistic side is betting on.

2026-10-22 ~ 2026-10-22 · 5 related posts

• [source] tszzl: Most new code will be written by AI models, so fewer security holes — tszzl · 2026-10-22
• [source] Anthropic's Chris Rohlf: AI can modernize code and shrink attack surface, not just find bugs — S1r1u5_ · 2026-10-22
• David Manheim: both AI attack and defense surfaces are too large to cover everything — davidmanheim · 2026-10-22
• [source] 'Cyberpocalypse' debate: prosaic cybersecurity is collapsing now, end-state contested — davidmanheim · 2026-10-22

1 near-duplicate retellings: davidmanheim