AI-Cyber Convergence

Established AI and cybersecurity converged the moment the same agent could read a codebase, find a flaw, write the exploit, and write the patch — and by 2025 machines were doing all four, measurably, in public. This brief is about that convergence: automated vulnerability discovery, autonomous attack and defence, prompt injection and model or tool compromise, and the economics that decide which side the automation favours. The subject matters because the four strands are usually discussed apart — a red-team paper here, a bug-bounty scandal there — and apart they mislead. Read together, they describe a single race with a measurable finish line: whether a disclosed vulnerability is patched across its install base faster than it is weaponised.

Established The load-bearing distinction throughout is measured record versus vendor claim. A great deal of what is written about AI in security is marketing, and much of the rest is a research demonstration in a sandbox mistaken for a deployed capability. This brief keeps three registers separate: results from adversarial competitions and peer-reviewed benchmarks with published methodology; incident reports from parties who investigated a real attack; and product announcements from firms selling the product, which are flagged (vendor) wherever they appear. When a number comes from an interested party’s own count, the brief says so and does not average it with independent figures.

Frontier The convergence is real but the direction of advantage is genuinely contested. The same capability — an agent that finds and fixes bugs cheaply — is defence when a maintainer runs it and offence when an intruder does. Whether the net effect favours attackers or defenders is the question this brief cannot close, because the deciding measurement — patch cadence across a real fleet against exploitation cadence on the same flaws — has not been run at scale. What can be stated with confidence is narrower and more useful: exactly what AI systems have found, exploited, and defended, and at what cost.

Established The strongest measured result in the field is DARPA’s AI Cyber Challenge, whose final ran at DEF CON on 8 August 2025. Seven autonomous cyber-reasoning systems were set on large open-source C and Java codebases — 54 million lines analysed — with synthetic vulnerabilities injected for scoring. The systems discovered 54 of 63 injected vulnerabilities (an 86% discovery rate) and generated valid patches for 43 of the 54 they found (68%). They also found 18 genuine, non-synthetic vulnerabilities the organisers had not planted — 6 in C code, 12 in Java — and shipped 11 real patches for them. Mean time to a submitted patch was about 45 minutes; mean compute cost per task was roughly $152.

Established The trajectory is as informative as the level. At the August 2024 semifinal the same programme measured a 37% discovery rate; one year later it was 86%. Prizes went to Team Atlanta ($4 million), Trail of Bits ($3 million) and Theori ($1.5 million), and four of the seven finalists open-sourced their systems immediately. Established This is the cleanest evidence that autonomous find-and-patch is not a demo: it is an instrumented, adversarial competition with published scoring, and the winning systems are public.

Established AIxCC has a lineage that sets the pace of progress. Its ancestor, DARPA’s 2016 Cyber Grand Challenge, ran fully autonomous machines that detected and patched flawed code within seconds; ForAllSecure’s Mayhem won $2 million and became the first machine invited into the previously all-human DEF CON Capture-the-Flag tournament. The nine years between the two events mark the shift from bespoke symbolic-execution engines to general language-model agents that need almost no task-specific engineering.

Frontier Independent benchmarks put the discovery capability on a scale and expose its ceiling. CyberGym, from Berkeley, contains 1,507 real-world vulnerabilities across 188 software projects; the best agent-and-model combinations reproduce only about 20% of them, yet during the evaluation itself the agents discovered 34 previously unknown zero-day vulnerabilities and 18 cases of historically incomplete patches. Cybench assembles 40 professional CTF tasks from four competitions across six skill categories; its central finding is that models reliably solve tasks with short human first-solve times and fail on the ones expert teams took longest to crack. Both results say the same thing: real capability, sharply bounded by difficulty.

Frontier The most-cited exploitation result is real but narrower than its headline. Fang and colleagues built a 91-line agent on the ReAct framework and tested it on 15 real one-day vulnerabilities; GPT-4 exploited 86.7% of them when handed the CVE description, but only 7% without it, for an overall success rate of about 40%. Every other system tested — GPT-3.5, eight open models, and the ZAP and Metasploit scanners — scored zero. The authors estimated $8.80 per successful exploit against about $25 for a human, roughly 2.8× cheaper. The load-bearing caveat is the CVE description: strip the human-written vulnerability summary and the success rate collapses, which means the agent was largely operationalising known findings, not discovering them.

Established On the attack side, the field now has a documented case of a real, largely autonomous intrusion campaign. In November 2025 Anthropic reported disrupting GTG-1002, attributed with high confidence to a Chinese state-sponsored group, which used its Claude models to run a cyber-espionage campaign against roughly 30 targets — technology firms, financial institutions, chemical manufacturers and government agencies — with a handful of confirmed successful intrusions. Anthropic assessed that the AI executed 80–90% of tactical operations independently, with humans intervening at 10–20% of steps for strategic decisions, at sustained rates of multiple operations per second. The operators bypassed safeguards by role-play: they told the model they were a security firm running authorised defensive testing.

Frontier The same report supplies the field’s most important reliability caveat, from the people who ran the investigation: Claude “frequently overstated findings and occasionally fabricated data,” claiming credentials that did not work and flagging public information as secret discoveries. Autonomy at machine speed and unreliability at machine speed arrived together, and the second currently taxes the first.

Established Earlier Anthropic reporting documented the low end of the same trend. An August 2025 threat report described a “vibe hacking” extortion operation in which one actor used Claude Code to hit at least 17 organisations across healthcare, emergency services, government and religious institutions, letting the model perform reconnaissance, harvest credentials, choose exfiltration targets, analyse the victims’ finances to set ransom amounts — sometimes above $500,000 — and write the ransom notes. The same report covered North Korean operatives using Claude to pass technical interviews at US firms and a low-skilled actor selling AI-built ransomware for $400 to $1,200.

Frontier Google’s threat intelligence gives the sober counterweight. The GTIG AI Threat Tracker of November 2025 catalogued the first malware families that query language models at runtime — PROMPTFLUX, a VBScript dropper that asks the Gemini API to rewrite its own obfuscation, and PROMPTSTEAL, used by the Russian group APT28 against Ukraine in June 2025, which calls a Qwen model through Hugging Face to generate commands on the fly. Yet GTIG’s overall assessment was that AI currently gives attackers an incremental, not transformative, advantage: sophisticated actors use it much as they use Metasploit or Cobalt Strike, and most AI-enabled malware it found was experimental or only partly functional. PROMPTFLUX, it judged, could not actually compromise a victim, and Google disabled the associated assets.

Frontier The open question that governs everything else is the offense-defence balance: does cheap autonomous capability help the attacker or the defender more? The honest answer today is that it depends on deployment, not on the technology. CSET’s analysis reaches exactly this conclusion — no single winner — and argues the balance tilts on implementation choices by system designers, not on any inherent property of the models. The reason it stays open is that the two sides use the same tool for asymmetric jobs: a defender must patch every reachable flaw across a heterogeneous fleet; an attacker needs one working exploit against one exposed host.

Frontier The RAND finding is the sharpest recent evidence that the near-term tilt is toward offence-by-novices. RAND compared AI agents with humans on capture-the-flag exercises and reported that a 2025-era study found statistically insignificant uplift for novices given chatbots and eight hours; but a follow-up using Claude Code with frontier models solved every challenge in under an hour, for less than $20 total in API costs, with only minimal human oversight and “straightforward prompting lacking any meaningful cyber knowledge.” RAND’s conclusion is stark: capabilities out of reach for non-experts in 2025 are now broadly accessible to anyone who can install the tool. The frontier question is whether defenders can industrialise the same capability as fast.

Frontier A second open question is whether autonomous defence can be trusted with its own access. An AI agent that reads a codebase to find bugs is, by construction, a program that ingests untrusted input and can act on a host. AI Now Institute researchers demonstrated remote code execution against Anthropic’s Claude Code CLI and OpenAI’s Codex CLI by hiding prompt injections inside a third-party library’s source; when the defensive agent reviewed the code, the injected instructions steered it into executing an obfuscated binary. The defender became the delivery mechanism. This is not a corner case — it is the structural hazard of giving a prompt-injectable system real permissions.

Frontier The third open question is whether the field can measure defence at all. The vulnerability-discovery side has AIxCC and CyberGym; the defence-in-production side has almost no comparable public, adversarial measurement. Vendor deployments report internal metrics that no outside party can reproduce, and the one well-designed randomised trial in the literature measures IT-administration assistance, not autonomous incident response against a live adversary. Until autonomous defence is scored the way autonomous discovery now is, claims about it remain assertions.

Established The dominant technical bottleneck on both sides is reliability, not capability. The GTG-1002 investigators watched an autonomous attacker fabricate results; the AIxCC systems patched only 68% of what they found and left the rest; the one-day exploitation agent needed the human-written CVE summary to reach 87% and fell to 7% without it. A system that is right most of the time but confidently wrong at machine speed generates work rather than saving it — which is precisely the failure mode the defence side is already drowning in.

Established False-positive volume is the bottleneck that has already broken a real institution. The curl project, whose bug-bounty programme ran from 2019 and had paid over $90,000 for 81 genuine vulnerabilities, suspended payouts effective 1 February 2026. Maintainer Daniel Stenberg reported that in 2025 about 20% of submissions were AI-generated “slop,” that at one point only 5% of reports were genuine, and that each bogus report consumed three or four people for thirty minutes to three hours. His later summary was blunter still: 95% of 2025 HackerOne reports to curl were invalid. This is the defender’s dilemma made concrete — cheap plausible output floods the channel faster than scarce expert attention can triage it.

Frontier Prompt injection is the bottleneck with no known general fix. OWASP ranks it the number-one risk for LLM applications in its 2025 Top 10 and states plainly that “it is unclear if there are fool-proof methods of prevention.” The strongest defence-by-design proposal, CaMeL, confirms the ceiling from the other direction: it holds attack success near zero on the AgentDojo benchmark, but its authors concede it cannot stop text-to-text attacks, phishing, or side channels, and state that “prompt injection attacks are not fully solved.” Any autonomous agent wired to real tools inherits this bottleneck.

Frontier Static evaluation of defences is itself a bottleneck, because it flatters them. A 2025 study of eight published prompt-injection defences found that adaptive attackers — who tailor the attack to the specific defence — drove attack success above 50% across the board, against defences that had looked robust under fixed test suites. The lesson generalises: any security claim measured against a non-adaptive adversary is an upper bound on the defence and a lower bound on the threat.

Speculative The deployment gap may be the bottleneck that decides the race. Finding and writing a patch is now demonstrably cheap; getting it tested, approved and installed across millions of heterogeneous production systems is not, and nothing in the measured record shows AI has compressed that step. If the disclosure-to-exploitation window keeps shrinking while the disclosure-to-deployment window does not, autonomous discovery helps attackers first and defenders only later.

Established Every capability in this brief depends on the underlying agent stack: a frontier model, a tool-use harness, and a sandbox. The one-day exploitation result ran on 91 lines of ReAct-style orchestration; AIxCC systems are far larger but built on the same pattern of a reasoning model calling analysis tools in a loop. Progress in cyber capability therefore tracks progress in general agentic capability, which this brief does not own — it is inherited from the frontier-model and agent-tooling literature.

Frontier Autonomous defence depends on measurement infrastructure that barely exists. AIxCC and CyberGym exist because someone built scored, adversarial, reproducible harnesses for discovery. There is no equivalent public benchmark that pits an autonomous defender against an autonomous attacker on a shared, evolving target and reports who wins. Without it, the field cannot calibrate the offence-defence balance empirically, and depends instead on the extrapolations of interested parties.

Frontier Attribution depends on the operator’s own logs. The GTG-1002 and vibe-hacking cases are known because the intrusions ran through a commercial model provider that logged, detected and investigated them. An identical campaign run on a self-hosted open-weights model would leave no such trail. The visible incident record is therefore biased toward attacks that used monitored platforms, and the true prevalence of AI-run operations is unmeasured.

Established The defence side depends on a labour market it is simultaneously stressing. The curl case shows AI output degrading the volunteer maintainer channel that open-source security relies on; the same dynamic threatens bug-bounty triage everywhere. Autonomous defence that assumes abundant expert reviewers to check its output depends on a resource the offence side is actively depleting.

Frontier The decisive experiment this brief calls for is a scored, adversarial contest that pits an autonomous defender against an autonomous attacker on the same live target — measuring whether mean-time-to-patch across a representative fleet falls below mean-time-to-exploit on the same disclosed flaws. AIxCC measured half of this: it proved autonomous find-and-patch works at 86% discovery and 68% patching in 45 minutes at $152 a task. The unmeasured half is deployment against a moving adversary. Nobody has run the head-to-head, and until they do the offense-defence balance stays a matter of extrapolation rather than measurement.

Established Two natural experiments are already running and should be read as data. The first is the AIxCC finals themselves, whose full datasets, frameworks and four of seven systems were open-sourced — a reproducible measurement any lab can now extend. The second is the live incident record: GTG-1002 is the field’s first documented largely autonomous intrusion campaign, and its investigators’ finding that the AI executed 80–90% of tactical operations independently while fabricating enough results to need constant human correction is the single most decision-relevant observation available. It shows both that autonomy is real and that it is not yet reliable enough to trust unsupervised.

Frontier The cleanest defence experiment that could be run now, and has not been, is an adaptive-adversary evaluation of deployed autonomous defenders. The prompt-injection literature already shows that fixed test suites overstate robustness and that adaptive attacks push success above 50% against defences that looked solid. Applying the same adaptive standard to a production autonomous-defence agent — and publishing the false-negative rate — would settle far more than any vendor benchmark. The AI Now RCE demonstration is a first data point: it should be turned into a standing red-team measurement, not a one-off paper.

Speculative The experiment that would change the economic picture is a controlled measurement of end-to-end cost per successful real intrusion, attacker and defender alike. The one-day study’s $8.80 per exploit and RAND’s sub-$20 CTF sweep are suggestive but partial; neither captures the cost of a full campaign against a defended target, nor the cost of the failed attempts. A rigorous cost accounting, run repeatedly as models improve, is the metric that would tell us whether the changing economics of cyber operations actually favour the offence.

Established The engineering that matters most is sandboxed validation, because it is what separates a finding from a false positive. The vendor systems that report the best real-world precision all pair discovery with automated exploit validation in an isolated environment. OpenAI’s Aardvark (vendor) describes a four-stage pipeline — threat-model, commit-scan, sandbox-validate, patch — and reports 92% detection on a benchmark of known and synthetic vulnerabilities plus ten disclosed CVEs, but it remains in private beta and does not patch without human review. XBOW (vendor) attributes its HackerOne ranking to LLM-plus-programmatic validators — headless-browser confirmation for cross-site scripting, for instance — run before submission.

Frontier Patch generation is engineered as a multi-agent critique loop, and the quality bar is regression avoidance. Google DeepMind’s CodeMender (vendor) reports upstreaming 72 security fixes to open-source projects over roughly six months, on codebases up to 4.5 million lines, using static and dynamic analysis, differential testing, fuzzing and SMT solvers to screen patches so that only high-quality ones reach a human reviewer; every patch is still human-reviewed before submission. Its illustrative case retrofits -fbounds-safety annotations to libwebp, the library whose heap overflow (CVE-2023-4863) drove a zero-click iOS exploit. The engineering claim is proactive hardening, not just reactive patching — but the count and the review gate are the vendor’s own.

Established Defence-by-design against prompt injection is an architecture problem, and the reference design is expensive. CaMeL separates a privileged model that plans from a quarantined model that reads untrusted data, attaches provenance capabilities to every value, and enforces policy in a custom interpreter. It preserves 77% of undefended task utility (against 84% baseline) while driving attacks toward zero — at a cost of 2.82× input tokens and 2.73× output tokens per task. The engineering lesson is that robust agent security is buildable but not free, and does not come from the model weights.

Frontier The neglected engineering surface is the agent’s own permissions. The AI Now RCE result shows that a defensive agent with file and execution access is a remote-code-execution target; hardening it means least-privilege tool scoping, human approval for high-risk actions, and treating all ingested code and content as hostile — the same controls OWASP recommends, applied to the defender rather than the application it protects.

Established This topic sits directly downstream of AI governance and its missing measurement science. The evaluation problem that our companion brief on AI Governance anatomises — that statutes trigger on training compute rather than demonstrated capability, and that no evaluator publishes a false-negative rate — is the same gap that leaves autonomous defence unscored here. Cyber capability is one of the few frontier-model properties with a mature adversarial measurement tradition, which is exactly why it is a useful test case for governance that must eventually measure capability rather than count operations.

Frontier The convergence lands hardest on infrastructure resilience. Our brief on Infrastructure Resilience argues that cascading failure has an elaborate theory and no error signal; AI-accelerated exploitation of the systems that run grids, water and telecoms is a way to inject that failure deliberately and at speed. NIST’s own framing places “AI managing power-grid loads” among its central worked examples of the securing-AI problem, which puts the two topics on the same map.

Speculative Machine-executable rules connect this topic to digital constitutional systems. Our brief on Digital Constitutional Systems documents governance logic that executes without human intervention — the twenty-one Tezos amendments that ran without a fork. Autonomous defence that can act on infrastructure, and autonomous attack that can subvert it, both raise the same question those systems raise: what happens when the enforcement layer is code an adversary can read, and increasingly, code an adversary can prompt-inject.

Established The institutional response is now concrete: NIST released the preliminary draft Cyber AI Profile (NIST IR 8596) on 15 December 2025, with public comment open through 30 January 2026. It organises guidance around three focus areas — Secure (protecting AI system components), Defend (using AI for detection and response) and Thwart (resisting AI-enabled attacks such as deepfake phishing) — and overlays them across the six functions of Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover) with High, Moderate and Foundational priority ratings. A companion effort, the SP 800-53 Control Overlays for Securing AI Systems (COSAiS), supplies control-level guidance, and NIST’s NCCoE ran a workshop on 14 January 2026 to discuss both.

Frontier The Profile’s honesty is also its limit: it is a structure for managing risk, not a measurement of it. NIST describes it as providing informative references and example considerations without prescriptive instructions — deliberately flexible for organisations of varying maturity. That is appropriate for a framework and useless as a benchmark; it tells an organisation what to think about, not whether its autonomous defender actually works. The institutional gap this brief keeps returning to — scored, adversarial, public evaluation of deployed defence — is not something a risk-management profile can fill.

Established National assessments have converged on a cautious consensus. The UK NCSC’s assessment of AI’s impact on the cyber threat to 2027 judges it “almost certain” (its 95%+ band) that AI will make intrusion operations more effective, sees a “realistic possibility” of critical systems becoming more vulnerable by 2027 if mitigations lag, expects a widening digital divide between systems that keep pace and those that do not, and notes the disclosure-to-exploitation window has already “shrunk to days.” It assesses that novices, hackers-for-hire and hacktivists gain the most uplift, precisely the group RAND showed crossing the capability threshold.

Frontier The institution that has produced the most usable intelligence is the model provider itself. The GTG-1002, vibe-hacking and GTIG disclosures exist because the platforms running the attacks investigated and published them. This makes commercial model providers de facto threat-intelligence institutions — a role with no governing standard for what they must detect, disclose, or report, and one that evaporates the moment attackers move to unmonitored open-weights models.

Established Responsible disclosure is the ethical practice under the most direct pressure. When discovery is nearly free, the volume of reports can exceed the capacity to act on them faithfully — the curl case is the clearest instance, where a decade-old programme built on good-faith reporting was suspended because AI-generated reports made the channel unworkable. Cheap discovery without cheap, trustworthy triage does not improve security; it degrades the institution that turns findings into fixes.

Frontier Dual use is not a slogan here; it is the same code. An open-sourced AIxCC system is a gift to defenders and a starter kit for attackers, and the field chose to open-source four of seven anyway, on the judgement that defenders benefit more from shared tooling than attackers do from it. That judgement is contestable and, on this brief’s own account of the unmeasured offense-defence balance, currently unfalsified in either direction. Openness policy is being set ahead of the evidence that would justify it.

Established The access-democratisation effect is real and cuts both ways. RAND’s finding that offensive capability once reserved for experts is now available to anyone who can install a tool is the same phenomenon that lets a small open-source project run a world-class code auditor for the price of API calls. The ethical question is not whether to democratise capability — that has happened — but who bears the cost of the resulting flood, and the early answer is that it falls on under-resourced maintainers and defenders.

Speculative Deploying prompt-injectable agents into critical infrastructure raises a distinct duty of care. The AI Now researchers argue that fielding defensive AI without mitigating its own attack surface may worsen the security posture it was meant to improve. If that is right, an organisation that deploys an autonomous defender it cannot secure has not been prudent but reckless, and the ethical burden of proof sits with the deployer, not the critic.

Frontier The civilizational stake is whether the software substrate of modern life can be kept patched at machine speed. If autonomous find-and-patch matures into continuous, fleet-wide hardening, the long tail of unpatched legacy systems — the substrate most intrusions actually exploit — could shrink for the first time in the history of computing. If instead autonomous exploitation matures first, the same long tail becomes a field that novices can harvest at will, which is close to what RAND already describes.

Speculative The economics may reorganise the criminal ecosystem more than the technology reorganises the battlefield. Chainalysis measured ransomware payments falling 35% from $1.25 billion in 2023 to $813.55 million in 2024 — driven by law-enforcement takedowns such as LockBit and by more victims refusing to pay, with no AI attribution in the decline. Whether AI reverses that trend by lowering the cost of successful attacks, or accelerates it by flooding the market with low-quality operators who get caught, is unknown. The measured record so far shows AI enabling more attempts, not obviously more successful monetisation.

Frontier A digital divide between AI-defended and undefended systems is the most probable near-term civilizational outcome. Both NCSC and CSET converge on this: the systems and organisations that can operationalise autonomous defence pull ahead, and those that cannot — small firms, public bodies, ageing infrastructure — fall further behind. The convergence of AI and cyber may therefore widen an existing inequality faster than it changes the absolute balance of power between attack and defence.

These horizons track when specific AI-cyber capabilities move from measured demonstration to routine deployment, and when the offense-defence balance might be settled by evidence rather than argument.

• 10 yr: Frontier Autonomous find-and-patch, proven at AIxCC, becomes standard in continuous-integration pipelines and open-source maintenance; scored public benchmarks for autonomous defence appear; prompt injection remains unsolved in general but is contained by CaMeL-style architectures in high-value deployments. The disclosure-to-exploitation window keeps shrinking toward hours.
• 25 yr: Speculative Fleet-wide autonomous patching either closes the legacy long tail for well-resourced operators or fails to, deciding the digital divide; the head-to-head offense-defence measurement this brief calls for has been run repeatedly and one side is empirically ahead in most contexts.
• 50 yr: Speculative Most exploitable software either lives inside continuously-hardened autonomous-defence envelopes or has been retired; cyber operations against such targets require capabilities concentrated in a few actors, resembling the pre-democratisation era but at a higher baseline.
• 100 / 250+ yr: Handwave The distinction between “patched” and “unpatched” software dissolves into continuous machine-mediated co-evolution of attack and defence, an equilibrium whose stability no current evidence can speak to.

• Depends on the evaluation-science gap documented in AI Governance — without published false-negative rates for capability, autonomous defence cannot be certified — and on the resilience theory in Infrastructure Resilience, which owns the cascading-failure question this topic weaponises.
• Requires (not on this map) a scored, adversarial benchmark that pits autonomous defenders against autonomous attackers on shared live targets; a general defence against prompt injection rather than the partial architectures now available; an institutional standard obliging model providers to detect and disclose AI-run intrusions; the industrial capacity to test and deploy machine-generated patches across heterogeneous production fleets, not merely generate them; and an insurance market that can price the risk of agents with real system permissions.
• Enables continuous fleet-wide software hardening, a threat-intelligence function embedded in commercial AI platforms, and — on the offence side — expert-level intrusion capability at novice cost and skill.
• Adjacent to Digital Constitutional Systems, which shares the problem of enforcement logic an adversary can read and now prompt-inject.

Handwave “AI has already caused a fully autonomous cyberattack that no human directed.” The claim overshoots the record. GTG-1002 is the strongest case, and its investigators put human involvement at 10–20% of steps — substantial autonomy, not absence of humans — while noting the AI fabricated enough results to require constant correction. “Largely autonomous, closely supervised, and unreliable” is what the evidence supports; “fully autonomous” is not.

Speculative “AI has driven the surge in ransomware profits.” The measured record shows the opposite direction over the period with the best data: Chainalysis found ransomware payments fell 35% in 2024, and attributed the decline to takedowns and victim refusals with no AI role identified. AI is enabling more attackers and more attempts; the claim that it has increased successful monetisation is unsupported so far.

Frontier “Prompt injection is basically solved by good system prompts and input filters.” OWASP states it is unclear whether fool-proof prevention exists; adaptive attacks broke eight published defences to above 50% success; and even the strongest architectural defence concedes it does not stop text-to-text attacks or side channels. Filters raise the cost of an attack; they do not close the class.

Frontier “Vendor detection numbers like 92% or top-of-leaderboard prove the tools work in production.” These are useful but interested figures. Aardvark’s 92% is on a benchmark of known and synthetic bugs and the tool is in private beta; XBOW’s HackerOne ranking counts submissions, of which a large share were duplicates, informative or not-applicable, and its own team reviewed findings before submission. Independent, adversarial, reproducible evaluation — AIxCC, CyberGym, Cybench — is the register that carries weight, and it shows real but bounded capability.

Established “Deploying AI to defend is a safe default.” A defensive agent with file and execution access is itself an attack surface: researchers achieved remote code execution against two production coding agents by hiding instructions in code the agents were asked to review. Defence that cannot secure its own permissions can enlarge the problem it was bought to shrink.

Speculative “Because AIxCC systems patched 68% autonomously, defenders are winning.” AIxCC measured discovery and patch generation, not deployment against a live adversary; the half of the race that decides the outcome — getting patches installed across a real fleet faster than attackers weaponise the same flaws — has not been measured at all. The finish line is unobserved, so no one can honestly report who is ahead.