Category: Cybersecurity

Categories
AI Cybersecurity

The Locksmith and the Ghost

For over two decades, some of the most sophisticated human minds in computer security — backed by Google’s project teams, millions of hours of automated fuzzing, and countless independent audits — stared at the same stretch of code. They were looking for flaws in OpenSSL, the cryptographic library that quietly underpins much of the internet’s security infrastructure. HTTPS connections, digital certificates, encrypted communications — OpenSSL is the invisible foundation beneath an enormous amount of what we trust online.

They didn’t find them. An AI did.

In January’s OpenSSL security release, twelve new zero-day vulnerabilities were disclosed — all twelve discovered by a single AI-driven research system called AISLE. Three of the bugs had been sitting in the code since 1998. One predated OpenSSL itself, inherited from Eric Young’s original SSLeay implementation in the 1990s. In five cases, the AI didn’t just find the flaw — it proposed the patch that was accepted into the official release.

Bruce Schneier, who has been writing about security longer than most of today’s AI researchers have been alive, offered a typically understated verdict: “AI vulnerability finding is changing cybersecurity, faster than expected.”

That last phrase — faster than expected — is doing a lot of work.

“This is a historically unusual concentration for any single research team, let alone an AI-driven one.”

What makes this story so arresting isn’t just the number twelve. It’s the age of what was found. A vulnerability that has survived twenty-five years of intense human scrutiny isn’t a simple oversight — it’s a ghost. It exists in a blind spot so deeply embedded in how human experts approach a problem that generation after generation of reviewers walked right past it.

AI doesn’t share our blind spots. It doesn’t get bored at line 4,000 of a C source file. It doesn’t carry the cognitive shortcuts that make experienced engineers efficient — and occasionally, selectively blind. It looks at the same code with fundamentally different eyes.

This is both the promise and the peril. Schneier notes, with characteristic precision, that this capability will be used by both offense and defense. The same system that finds vulnerabilities to patch them can, in other hands, find vulnerabilities to exploit them. The locksmith’s art has always had this dual nature. What changes now is the speed, the scale, and the fact that the locksmith no longer needs to sleep.

We are entering a period where the security of the infrastructure we depend on — the quiet plumbing of the digital world — will increasingly be determined by an AI arms race happening largely out of sight. The ghosts hiding in legacy code are being found. The question is who finds them first, and what they do next.

Questions to Consider

  1. The Blind Spot Problem: If AI can find vulnerabilities that decades of human expertise missed, what does that imply about other domains where we rely on accumulated expert consensus — medicine, law, financial risk modeling?
  2. Offense and Defense: The same capability that patches vulnerabilities can be weaponized to exploit them. How do we think about governing AI security research tools before the asymmetry tips decisively in one direction?
  3. The Legacy Code Crisis: Billions of lines of code written in the 1990s and early 2000s power critical infrastructure today. If AI can systematically audit that code, should there be a coordinated global effort to do so — and who would organize it?
  4. Trust and Verification: When an AI proposes a patch to a critical security flaw and human experts accept it, how confident are we that we understand why the patch works — and that it doesn’t introduce something new we can’t see?

Categories
AI Anthropic Claude Cybersecurity

The End of Obscurity

There is a particular kind of silence that surrounds a zero-day vulnerability. It is the silence of something waiting—a flaw in the logic, a gap in the armor, sitting unnoticed in the codebase for years, perhaps decades. We have slept soundly while these digital fault lines ran beneath our feet, largely because we assumed that finding them required a brute force that no one possessed, or a level of human genius that is incredibly rare.

But the silence is breaking.

I was reading Anthropic’s Red Team report from earlier this week (triggered by reading Bruce Schneier’s amazement), specifically their findings on the new Opus 4.6 model. The technical details are impressive, but the philosophical implication is what stopped me, like Bruce, cold.

For years, digital security has relied on “fuzzers”—programs that throw millions of random inputs at a system, banging on the doors to see if one accidentally opens. It is a noisy, chaotic, brute-force approach.

The new reality is different. As the report notes:

“Opus 4.6 reads and reasons about code the way a human researcher would—looking at past fixes to find similar bugs that weren’t addressed, spotting patterns that tend to cause problems.”

This is a fundamental phase shift. We are moving from the era of the Battering Ram to the era of the Jeweler’s Loupe. The machine is no longer guessing; it is understanding.

There is something deeply humbling, and slightly terrifying, about this. We have spent the last half-century building a digital civilization on top of code that we believed was “secure enough” because it had survived the test of time. We trusted the friction of complexity and the visibility of open source to keep us safe. We assumed that if a bug had existed in a core library for twenty years, surely it would have been found by now.

But the AI doesn’t care about time. It doesn’t get tired. It doesn’t have “developer bias” that assumes a certain function is safe because “that’s how we’ve always done it.” It simply looks at the structure, reasons through the logic, and points out the crack in the foundation that we’ve been walking over every day.

We are entering a period of forced transparency. The “security by obscurity” that held the internet together is evaporating. When intelligence becomes commoditized, vulnerabilities become commodities too. The question is no longer “is my code secure?” but rather, “what happens when the machine sees the flaws I cannot?”

It’s a reminder that complexity is a loan we take out against the future. Eventually, the bill comes due. We are just lucky that, for now, the entity collecting the debt is one we built ourselves, designed to tell us where the cracks are before the ceiling collapses. Let’s hope that we are out far enough in front of it.