If AI attackers spell doom, where are the agentic hacker hordes? Security researcher pushes back
zacharynado · x · 2026-10-25
Security researcher Joshua Saxe challenges the popular "vulnpocalypse" narrative in a researched essay (drafted with Claude Opus 5.5 Max). Key arguments:
- No discontinuity in damages: since scaled AI arrived, damages haven't jumped — the non-responsiveness of harm to rising AI capability is the central conceptual crux blocking AI security policy today.
- Cybercriminals aren't "Waluigi twins" of Stanford engineers: they are generally low-skill, recruited from middle- and lower-income countries with weak legal oversight, and struggle with arrests, sanctions, talent retention, and stable access to AI inference. Ransomware took years to become a scaled business under these conditions, so AI-native criminal syndicates will likely take a while too.
- Nation-states, by contrast, are quick to adopt AI for vulnerability work.
He also frames the recent PHP2Shell bug as a predictable, on-trend consequence of improving AI cyber capabilities — and a positive update, since defenders found and patched it alongside tens of thousands of other serious bugs.
Related event: Security veteran Joshua Saxe pushes back on "AI cyber doom" narrative(6 posts)→
More from AGI Musings
- How do you prove to your grandkids the past you remember wasn't AI-generated? — vinis_artstreaks · 2026-10-25
- AI safety researchers clash over whether agent covert-communication tests signal real risk — JacquesThibs · 2026-10-25
- Aaron Levie: cyber agents will soon process 1,000X more tokens as AI reshapes security — Kyrannio · 2026-10-25
- ryolu on AI agents: removing struggle may erode both learning and human bonds — ryolu_ · 2026-10-25
- Observation: everyone truly early to AI holds remarkably similar views on major questions — abhiadesai · 2026-10-25
- Viral "AI beats humans in peer review" study is mostly GPT grading Claude — JessicaHullman · 2026-10-25