Patch Surge, Not AI Hacking: The Vulnerability Debate

Episode 1 · Matthew Green: It's a Patch Surge, Not an AI Hacking Wave — and the Hardening Window Keeps Slipping (2026-10-22, 21 posts)

On October 22, Johns Hopkins cryptographer Matthew Green posted a flurry of tweets on the topic of "AI accelerating vulnerability discovery," with a core verdict: there is no so-called "AI-driven hacking explosion" underway right now—what's actually happening is an explosion of patching, plus one old-fashioned, low-level blunder unrelated to AI. Sociologist Zeynep Tufekci shares the same view. Green quipped that if this is the new speed of vulnerability discovery, he's actually reassured—everything gets hacked eventually anyway.

Confirmed

• Green's view: the AI danger is real and an attack wave may come in the future, but right now it's a patch explosion, not an attack explosion; Zeynep Tufekci expressed the same judgment.
• Green called for building datasets: for every major vulnerability discovered in the coming months, record whether maintainers ran AI auditing tools such as Mythos or Daybreak, to measure the share of hardening fixes attributable to them and quantify the real effectiveness of AI security tools.
• Green raised another key question: does AI-generated code that heavily depends on specific models have a higher or lower vulnerability rate than human-written code? He noted that no one systematically collects such data, though AI labs should be doing exactly that.
• Green amplified an observation from security researcher joaxcar: once someone finds a vulnerability with AI, reproduction becomes trivially easy—joaxcar spent 48 hours on heap alignment to find the first GitLab RCE with Codex, while others with full information reproduced it in about 1 hour, showing the attack barrier collapsing.
• Green debated security researchers including HackingLZ over whether AI significantly lowers the barrier to lethal cyberattacks: the other side argued that groups truly intent on killing via cyber means are limited and fear retaliation, and nation-state attackers already have other avenues.

Why it matters

• The discussion pulls the focus back from panic-driven narratives to measurable empirical questions: whether AI security tools actually reduce vulnerabilities, and whether AI-generated code is less secure—both currently lack systematic data.
• The asymmetry that vulnerabilities are "hard to find first, easy to reproduce" means the attack surface expands rapidly once a flaw is exposed, making patch speed the critical line of defense.

• Nate Soares: Glasswing missing a vuln for 6+ months indicts defense-over-offense thesis — So8res · 2026-10-22
• Matthew Green debates AI lowering the bar for lethal cyberattacks, citing jailbroken GLM 6 — matthew_d_green · 2026-10-22
• Zeynep Tufekci pushes back: we see a patching explosion, not an AI hacking explosion — zeynep · 2026-10-22
• Defenders' AI, not attackers, found the vulns — fueling AI offense-defense debate — cephaloform · 2026-10-22
• Researcher: AI cut GitLab RCE reproduction from 48 hours to 1, collapsing exploit lead time — matthew_d_green · 2026-10-22
• Cryptographer Matthew Green jokes AI's bug-finding speed means 'it'll all be over in six months' — matthew_d_green · 2026-10-22
• Matthew Green asks: are bugs found with AI auditors like Mythos and Daybreak being tracked? — matthew_d_green · 2026-10-22
• Cryptographer: AI labs should track whether AI security tools actually catch real vulnerabilities — matthew_d_green · 2026-10-22
• Cryptographer asks: is AI-generated code more or less likely to have vulnerabilities? — matthew_d_green · 2026-10-22
• Security researcher: no AI hacking explosion yet, just a patching explosion — matthew_d_green · 2026-10-22
• Security researcher accuses AI lab figure of mischaracterizing AI-found exploit — BlancheMinerva · 2026-10-22
• Blanche Minerva Accuses Nate of Cherry-Picking on AI Defense Audits — BlancheMinerva · 2026-10-22
• So8res: glasswing missing a bug for 6+ months indicts defense-beats-offense theory — harris_edouard · 2026-10-22
• Harris vs So8res: can AI-driven cyber defense ever fully match offense? — harris_edouard · 2026-10-22
• Vulnerability bonanza, yet no crypto black swan yet — and that's impressive — Kyrannio · 2026-10-23
• Security researcher: php2shell is no discontinuity, but now is the window to harden everything — joshua_saxe · 2026-10-23
• Cryptographer Matthew Green: the window to harden everything against AI attacks has slipped — matthew_d_green · 2026-10-24
• AI offense will move faster than defense, warns cryptographer Matthew Green — matthew_d_green · 2026-10-24
• Matthew Green: AI labs sounded the alarm, but it still wasn't enough — matthew_d_green · 2026-10-24
• Matthew Green: nobody has AI-scanned all remotely obtainable firmware — matthew_d_green · 2026-10-24

1 more related posts →

Episode 2 · Security Community Debates Whether OpenAI Waited Too Long on Dangerous Models (2026-10-24, 3 posts)

Security researchers are split over OpenAI and Anthropic's handling of dangerous cyber capabilities. Cryptographer Matthew Green argues the vendors wasted a four-month defender-only window, replying to defenders' praise with "but it was not enough."

• Matthew Green: AI labs wasted a 4-month defender-only window on cyber capabilities — matthew_d_green · 2026-10-24
• Security researchers clash over OpenAI's glasswing project and delayed cyber defense rollout — waral555 · 2026-10-24
• Matthew Green: 'And yet it wasn't enough' — matthew_d_green · 2026-10-24

Episode 3 · Cryptographer Matthew Green: Only ~5% of Vulnerable Software Fixed in 4-Month Window (2026-10-24, 2 posts)

Cryptographer Matthew Green criticized AI labs over a major security incident, noting that during a roughly four-month defensive window with near-exclusive access, only about 5% of vulnerable software was addressed.

• Matthew Green: only ~5% of vulnerable software covered during the 4-month defender window — matthew_d_green · 2026-10-24
• Matthew Green: Only ~5% of Vulnerable Software Fixed During Key 4-Month Window — waral555 · 2026-10-24