When AI Finds the Cracks Faster Than We Can Fix Them
Artificial intelligence is learning to uncover vulnerabilities that humans have overlooked for decades. But what happens when the technology we depend on begins advancing faster than our ability to secure it?
Imagine waking up tomorrow and discovering that your bank cannot process transactions.
Your phone still works, but several services are unavailable. A hospital across town has switched to emergency procedures after losing access to critical systems. Businesses are struggling to determine whether their networks have been compromised.
Not because of a natural disaster.
Not because a foreign military launched an attack.
But because someone discovered weaknesses in the software holding these systems together.
Now imagine that those weaknesses were identified, not by teams of expert hackers working for months, but by artificial intelligence operating at a speed those teams could never realistically match.
This is a hypothetical scenario. It is not a prediction that the internet is about to collapse.
But recent developments in artificial intelligence have made the underlying question increasingly relevant.
What happens when we develop technology capable of discovering problems faster than humanity can understand, verify, and repair them?
And perhaps more importantly, have we already begun crossing that threshold?
The Discovery That Changed the Conversation
In April 2026, artificial intelligence company Anthropic introduced an experimental model called Claude Mythos Preview.
Its cybersecurity capabilities were extraordinary.
During controlled testing, researchers reported that the model could independently identify and exploit previously unknown software vulnerabilities, including weaknesses in major operating systems and internet browsers.
One discovery involved a vulnerability in OpenBSD, an operating system with a reputation for strong security.
The weakness had existed for approximately 27 years.
Think about that.
For nearly three decades, a flaw existed inside software that humans had spent years developing, examining, maintaining, and securing.
Then an AI system discovered it.
The finding was not proof that artificial intelligence had suddenly become an unstoppable hacking machine. The vulnerability was patched, and discovering one weakness does not automatically grant access to every system using that software.
Nevertheless, it demonstrated something significant.
Software complexity had created opportunities for mistakes to remain hidden for decades. Artificial intelligence was developing the ability to find some of those mistakes with remarkable efficiency.
Anthropic responded by launching Project Glasswing, a collaboration intended to use advanced AI to discover vulnerabilities before malicious actors could exploit them.
By October 2026, Anthropic reported that its partners had identified at least 129,000 verified software vulnerabilities during the program's April-to-July period, alongside another 5,500 verified vulnerabilities found through its own open-source scanning through October.
More than 33,000 across those reported findings had been classified as high or critical severity.
These figures come from Anthropic's reporting, with limitations in partner participation and measurement. They do not mean that 134,500 systems had been hacked or that every vulnerability could produce a successful attack.
But they illustrate the scale of the discovery process.
For years, cybersecurity depended heavily on humans finding weaknesses, determining how dangerous they were, and developing solutions.
Now AI can accelerate the first part of that process dramatically.
Which creates a new problem.
Finding a weakness is not the same as fixing it.
And fixing it is not always the same as ensuring every vulnerable system has been updated.
Understanding the Threat: Finding a Weakness Isn't Breaking Everything
Before going further, we need to distinguish between several concepts that frequently get mixed together in discussions about artificial intelligence.
Reverse engineering is the process of examining a system to understand how it works.
Vulnerability discovery involves finding a flaw that could allow a system to behave in an unintended or insecure way.
Exploitation involves using a vulnerability to produce an unauthorized result, such as gaining access to information or executing commands.
Breaking encryption is something different. It generally means defeating the mathematical protections intended to keep information confidential or authentic.
These abilities can overlap, but they are not interchangeable.
Consider a bank vault.
Understanding how the vault was constructed does not necessarily mean you can open it.
Discovering that a particular hinge was installed incorrectly might reveal a vulnerability.
Successfully exploiting that weakness would require additional knowledge, access, and favorable circumstances.
And discovering a flaw in one particular vault does not mean every vault in the world is suddenly useless.
The same principle applies to computer systems.
In July 2026, Anthropic reported that its AI-assisted research had discovered weaknesses in two cryptographic research targets: HAWK, an experimental digital-signature algorithm under consideration for standardization, and a deliberately reduced-round version of AES encryption.
The HAWK finding was meaningful enough that its developers withdrew it from the standardization process.
However, the research did not demonstrate an ability to break the full AES cipher used in real-world systems. Nor did it compromise NIST's finalized post-quantum cryptographic standards.
In other words, artificial intelligence contributed to genuine advances in cryptographic research without making modern encryption obsolete.
That distinction matters.
Because exaggerating a real technological breakthrough can be just as misleading as dismissing it entirely.
The Argument That We Should Be Concerned
There is a legitimate reason cybersecurity researchers, governments, and technology companies are paying attention.
AI is changing the economics of cyberattacks.
Historically, sophisticated attacks often demanded highly specialized knowledge, significant resources, and considerable time.
Understanding complex software, identifying weaknesses, developing working exploits, and adapting those exploits to a target environment could be exceptionally difficult.
Now imagine a system capable of assisting with many of those tasks.
A malicious actor may no longer need the same level of expertise to perform certain technically demanding operations.
They may be able to automate parts of the process that previously required teams of experienced specialists.
By September 2026, the U.S. National Institute of Standards and Technology had evaluated GLM-5.3, an openly available AI model developed by Z.ai, and identified it as the most cyber-capable open-weight model it had evaluated up to that point.
This matters because advanced capabilities do not necessarily remain confined to a handful of major laboratories.
As AI models become more accessible, dangerous capabilities could become available to a wider population.
And not everyone using those capabilities will have good intentions.
But the most concerning part may not be the technology itself.
It may be the imbalance it creates.
An attacker sometimes needs only one exploitable weakness.
A defender must protect an enormous collection of systems, applications, accounts, devices, and connections.
One overlooked flaw might provide a path into an otherwise well-defended network.
And once discovered, some vulnerabilities can be reused against multiple organizations before patches are widely installed.
This raises an uncomfortable question.
What if the rate of vulnerability discovery begins accelerating beyond the rate at which organizations can respond?
The bottleneck could shift from identifying problems to handling the sheer number being discovered.
Verifying them.
Understanding their consequences.
Prioritizing the most dangerous ones.
Developing reliable patches.
Testing those patches.
Distributing updates.
And ensuring organizations actually install them.
Artificial intelligence might perform some of these tasks faster, too. But patching complex software can introduce new problems, and critical infrastructure cannot always be taken offline whenever a vulnerability is discovered.
At a certain scale, the challenge becomes organizational as much as technological.
And that is where the situation becomes particularly interesting.
The Other Side: What If AI Makes Us Safer?
There is another interpretation of these developments.
What if AI does not cause the collapse of cybersecurity?
What if it helps solve problems that humans were never equipped to address at this scale?
Consider the 27-year-old OpenBSD vulnerability.
For decades, the weakness existed without being discovered and corrected.
Its presence represented a security risk regardless of whether anyone knew about it.
Artificial intelligence did not create that weakness.
It helped expose it.
Once researchers discovered the problem, developers could address it.
The same principle applies to thousands of other software vulnerabilities.
Perhaps the true danger was never that artificial intelligence would begin finding them.
Perhaps it was that we had been relying on systems containing unknown weaknesses while assuming that years of human review had made them sufficiently secure.
AI may be revealing how incomplete that assumption was.
There is a practical argument for giving defensive cybersecurity teams access to increasingly capable AI.
If an AI system can discover vulnerabilities, perhaps another can help verify them, identify which systems are affected, recommend corrections, and test whether those corrections work.
Some of this is already possible.
The challenge is making those defensive capabilities reliable, accessible, and safe enough for widespread deployment.
And there are reasons for caution.
An AI can misidentify a problem, recommend an incorrect fix, or overlook the consequences of changing complex software.
A poorly tested security update can disrupt legitimate operations.
Human judgment, independent verification, and careful engineering remain necessary.
Even so, the defensive potential is substantial.
We may be witnessing the beginning of a cybersecurity arms race in which artificial intelligence strengthens both the attacker and the defender.
The outcome is not predetermined.
The Systems We Don't Think About
Most people associate cybersecurity with passwords, smartphones, and stolen credit-card information.
But digital technology extends far beyond personal devices.
Modern civilization relies on interconnected software to coordinate enormous portions of daily life.
Banking and financial transactions.
Electrical distribution.
Water treatment.
Hospitals and medical equipment.
Transportation and shipping.
Communication networks.
Emergency response systems.
Military logistics and government operations.
Not every one of these systems is equally exposed to the internet. Many incorporate physical safeguards, isolated networks, backup procedures, and multiple layers of security.
That distinction is important.
A vulnerability in one software component does not automatically mean an attacker can shut down an entire power grid or hospital.
Nevertheless, our dependence on digital infrastructure creates opportunities for failures to spread beyond their original point.
Imagine a regional healthcare network experiencing a serious cyberattack.
Even if medical equipment remains functional, losing access to patient records, scheduling systems, laboratory results, or administrative tools could create dangerous disruptions.
Now imagine multiple organizations depending on the same vulnerable software provider.
A single underlying weakness could affect numerous institutions.
That is not evidence that AI will inevitably cause widespread infrastructure failure.
It is an illustration of why cybersecurity has become inseparable from national security, economic stability, and public safety.
The more interconnected our systems become, the more important it is to understand where those connections create shared vulnerabilities.
A Thought Experiment: What Happens When Discovery Becomes Nearly Instantaneous?
Suppose that over the coming years, artificial intelligence continues improving.
Eventually, a sufficiently capable AI system might be able to examine enormous quantities of software, identify promising vulnerabilities, and generate candidate exploits faster than large teams of human researchers.
Now suppose similar capabilities become available to both security professionals and criminals.
What happens next?
One possibility is that defenders begin using AI to continuously examine their infrastructure.
Vulnerabilities are identified earlier. Patches are created more efficiently. Security improves because hidden weaknesses have less time to remain undetected.
Another possibility is that attackers exploit discoveries before defenders have sufficient time to respond.
Organizations become overwhelmed by reports. Software maintainers face a growing backlog of unresolved vulnerabilities. Older infrastructure becomes increasingly difficult to protect.
A third possibility is that both outcomes occur simultaneously.
Some organizations become dramatically more secure while others fall further behind.
Those with the resources, expertise, and infrastructure to deploy advanced defensive systems may benefit.
Those without them may become increasingly vulnerable.
This could create a new kind of technological inequality.
Not simply between people who have access to artificial intelligence and those who do not.
But between institutions capable of adapting at the speed of AI and those that cannot.
That distinction deserves serious consideration.
Because a society can possess extraordinary technological capabilities while remaining dangerously uneven in its ability to use them responsibly.
The Psychological Trap: Confusing Possibility With Inevitability
There is another side to this issue that goes beyond cybersecurity.
Human psychology.
When we encounter something powerful that we do not fully understand, we naturally begin imagining its consequences.
Sometimes those imagined consequences become catastrophic.
AI can find hidden vulnerabilities.
Therefore, AI will break encryption.
AI can break security systems.
Therefore, banks will collapse.
Banks could collapse.
Therefore, civilization is approaching some unavoidable technological disaster.
Notice what happens.
Each conclusion becomes more extreme than the evidence supporting the one before it.
A demonstrated capability becomes a predicted outcome.
A possible outcome becomes an assumed certainty.
That does not mean the original concern is irrational.
It means we have stopped separating evidence from speculation.
And this happens in both directions.
Some people see every AI breakthrough as a warning that humanity is approaching catastrophe.
Others dismiss virtually every concern as science fiction or fearmongering.
Both reactions can prevent us from examining the underlying mechanisms.
The responsible question is not whether artificial intelligence is good or evil.
Nor is it whether we should be excited or terrified.
It is what the technology can actually accomplish, under what conditions, with what limitations, and what consequences are realistically supported by the evidence.
Understanding uncertainty is not the same as ignoring danger.
In fact, taking a threat seriously requires resisting the temptation to exaggerate it.
The Question Beneath the Technology
The more I examine this subject, the less I think the most important question is whether artificial intelligence will eventually become better than humans at finding vulnerabilities.
We already have evidence that advanced models can outperform many human-led approaches on particular security tasks.
The deeper question is what happens when our capacity to discover problems grows faster than our institutions' capacity to respond.
And this question extends beyond computer software.
Imagine artificial intelligence accelerating scientific research faster than regulatory institutions can evaluate its implications.
Or producing persuasive information faster than people can verify its accuracy.
Or reshaping industries faster than workers, educators, and governments can adapt.
These are different problems with different solutions, but they may share an underlying tension.
Technological progress does not automatically produce an equal increase in human wisdom, judgment, or institutional competence.
We can develop powerful tools without developing equally powerful systems for using them responsibly.
That does not mean progress should stop.
It means our understanding of progress may need to expand.
Maybe the question should not simply be how much faster we can make artificial intelligence.
Maybe we should also be asking how much better we can become at managing the changes it creates.
So, Are We in Trouble?
There is no credible evidence that artificial intelligence has rendered global cybersecurity obsolete or that a worldwide digital collapse is inevitable.
Modern security systems remain protected by multiple layers of defenses, and researchers are actively developing new tools to counter emerging threats.
But there is substantial evidence that AI is transforming cybersecurity.
It is becoming increasingly capable of discovering software vulnerabilities, developing exploits, and accelerating tasks that once required considerable human expertise.
Those capabilities introduce genuine risks.
They also create extraordinary defensive opportunities.
Which side gains the advantage will depend on more than the models themselves.
It will depend on how governments, developers, researchers, infrastructure operators, and the public respond.
And perhaps that is the most uncomfortable realization.
We may not be approaching a world where artificial intelligence simply destroys our security.
We may be approaching a world where the weaknesses we have spent decades overlooking become impossible to ignore.
Artificial intelligence may not be creating all the cracks in our systems. It may simply be revealing how many were already there.
A Question for the Reader
Imagine we develop an artificial intelligence capable of identifying nearly every major weakness in our critical infrastructure.
The technology could make those systems safer than ever before.
But the same discoveries could become extraordinarily dangerous in the wrong hands.
Would you favor making such technology widely available so more people can identify and repair vulnerabilities?
Or would you restrict access, knowing that doing so might prevent defenders from finding weaknesses that someone else could eventually exploit?
And perhaps the most difficult question:
What happens when our ability to discover what is wrong with the world surpasses our ability to make it right?
That is the conversation worth having.
Beneath The Brain exists to examine difficult questions from multiple perspectives, challenge assumptions, and encourage independent thought. The purpose is not to tell you what to believe, but to give you something worth thinking about.
Question Everything. Think Deeper.
Sources & Further Reading
-
Anthropic — Project Glasswing: Securing Critical Software for the AI Era (April 7, 2026)
https://www.anthropic.com/glasswing -
Anthropic — Expanding the Cyber Verification Program (October 6, 2026)
https://www.anthropic.com/news/cyber-verification-program -
NIST — Assessment of Z.ai's GLM-5.3 Cyber Capabilities (September 17, 2026)
https://www.nist.gov/news-events/news/2026/09/caisis-assessment-zais-glm-53-cyber-capabilities -
Anthropic — Discovering Cryptographic Weaknesses with Claude (July 28, 2026)
https://www.anthropic.com/research/discovering-cryptographic-weaknesses -
NIST — Post-Quantum Cryptography, including the July 2026 HAWK update
https://www.nist.gov/pqc -
Matthew Green — Some Thoughts About Anthropic's New Cryptanalysis Results (July 29, 2026)
https://blog.cryptographyengineering.com/2026/07/29/