Security researcher: offense is hard to automate, defending known vuln classes is easier
mboehme_ · x · 2026-11-02
Security researcher mboehme analyzes the asymmetry of automating security with LLMs:
- Offense is hard to automate: you can't tell whether a feature is a vulnerability until it's exploited, so automated offense mainly helps us understand which vulns exist in the first place.
- Defense is easier to automate: defending against known classes of vulnerabilities is much more tractable, as recent advances in large-scale verification show.
- He draws an analogy to math: coming up with a conjecture requires intuition and high-level understanding, while proving one is evidently much easier — as demonstrated by the recent dump of AI-generated mathematical proofs.
More from Safety
- Cyber attack on Swedish smart fridges causes mass food spoilage at supermarket — Polymarket · 2026-11-02
- How to opt out of Meta, OpenAI, and Apple training AI on your data in the UK — HotMinuteUK · 2026-11-02
- AI safety researcher: AI companies entirely lack this kind of effective human oversight — davidmanheim · 2026-11-02
- offprompt: MIT-licensed MCP server hands agents API keys without ever exposing them — Vast_Ad_7338 · 2026-11-02
- Epoch AI: open-weight GLM 5.3 exploited the patch gap to hack 6 Firefox releases at ~$1,000 each — rohanpaul_ai · 2026-11-02
- Marcel Böhme's paper asks why cybersecurity can never be solved, proposes vulnerability-guided hardening — mboehme_ · 2026-11-02