Security researcher: offensive security resists automation, inferring error specs is next frontier
mboehme_ · x · 2026-11-02
Security researcher mboehme argues that offensive security is hard to automate because you often don't know a feature is a security issue until it's actually exploited — attacks are how the community discovers which issues exist in the first place. Defensive security, by contrast, is easier to automate, as recent advances in formal verification demonstrate.
He draws an analogy to mathematics: coming up with a conjecture requires intuition and high-level understanding, while proving one is evidently much easier, as shown by the recent wave of AI-generated mathematical proofs. Applying this to security: what counts as a vulnerability is highly domain-specific, often even program-specific, and demands intuition plus expert knowledge. Automatically inferring these "error specifications" will, in his view, be the next frontier in security.
More from AGI Musings
- Carl Frey: 85% in China see AI as beneficial vs 38% in US — resistance maps to expertise costs — carlbfrey · 2026-11-02
- After a painful rebuild, fejau concedes: build on Hermes and you own your AI for life — Teknium · 2026-11-02
- 'Meatwashing': manually rewriting AI output to hide its origin, and why it's a double waste — JeremyNguyenPhD · 2026-11-02
- AI safety researcher: AI companies entirely lack this kind of effective human oversight — davidmanheim · 2026-11-02
- Long-read: AI's real value comes after the efficiency era—infra glut, agent tooling boom — yangyi · 2026-11-02
- vikhyat predicts alternating compute oversupply and undersupply on the road to AGI — TheZachMueller · 2026-11-02