AppSec Built for Human-Speed Threats Won't Survive AI-Agent Attacks, Researchers Warn
joshua_saxe · x · 2026-09-07
Security researcher matrosov argues that nearly everything built for application security assumed a threat model where a human had days to think — understand the problem, define a fix, then scale remediation. Prior approaches leaned on pre-generated heuristics (rules, SAT/SMT) or hypotheses (fuzzing harnesses), all viable only because humans understood the problem first. With AI-driven attacks, discovery and remediation must happen almost simultaneously — what caseyjohnellis calls "OODA loop compression." Teaching AI agents to drive the same tools doesn't fix it, and ineffective mitigations neither stop AI attackers nor buy time.
More from coding & agent
- Dense instance segmentation via Muse Wonder + SAM 3.1 on Meta's Model API — nikhilaravi · 2026-10-26
- Security tip: use AI agents to build a NIST CSF knowledge base for incident response — prasanna_says · 2026-10-26
- Google Cloud Adds Self-Learning Context Enrichment to Knowledge Catalog for AI Agents — rseroter · 2026-10-26
- Cloudflare Previews Spend Limits for Workers and Durable Objects, Early Access Open — ritakozlov · 2026-10-26
- Shopify design lead on AI-era workflow: designers are becoming full-stack editors — KlausCodes · 2026-10-26
- Nace AI launches Drex for Search, cutting agent steps 62% and tokens 56% — testingcatalog · 2026-10-26