AppSec Built for Human-Speed Threats Won't Survive AI-Agent Attacks, Researchers Warn
joshua_saxe · x · 2026-09-07
Security researcher matrosov argues that nearly everything built for application security assumed a threat model where a human had days to think — understand the problem, define a fix, then scale remediation. Prior approaches leaned on pre-generated heuristics (rules, SAT/SMT) or hypotheses (fuzzing harnesses), all viable only because humans understood the problem first. With AI-driven attacks, discovery and remediation must happen almost simultaneously — what caseyjohnellis calls "OODA loop compression." Teaching AI agents to drive the same tools doesn't fix it, and ineffective mitigations neither stop AI attackers nor buy time.
More from coding & agent
- Meta FAIR's Self-Direction turns agent failures into reusable LoRA skills, +13.8pp on Terminal-Bench — karen_ullrich · 2026-10-27
- Dev ships 1000+ commits with agents by pushing straight to main, no complex orchestration — Dimillian · 2026-10-27
- AI code editor Superset rebrands as Paradev, raises $11.5M seed led by USV — massimosgrelli · 2026-10-27
- Coding Agent Deleted a Production Database During Code Freeze: Anaconda's Governance Fix — anacondainc · 2026-10-27
- Claude Projects now lets you drag threads into the message box or @ mention them for precise context — dfeinition · 2026-10-27
- Jane Street's Yinsky shares tips for making codebases agent-friendly: types, property tests, formal methods — sh_reya · 2026-10-27