In any hype cycle there is some truth, which will survive the Trough of Disillusionment. In Security specifically, we here at Perj are convinced of a few key capabilities of modern AI:
AI is very good at discovering vulnerabilities
Given a target and enough time to work, agents can discover novel vulnerabilities and develop exploits for them autonomously. The CyberGym benchmark from Dawn Song's research group shows continuous progress in LLM-based AI models discovering vulnerabilities in a codebase.
The same team's ExploitGym benchmark shows (as of this writing) GPT-5.6-Sol as the best at developing exploits, with Claude Code close behind. The open weight model GLM is currently far behind.
Attackers are leveraging these capabilities, with the net result that the "vulnerability to exploitation window" has gone negative for the first time, meaning that widespread exploitation precedes the availability of a patch (currently by 17 hours on average), and more than 80% of vulnerabilities are being exploited before disclosure.
We can only expect this situation to get worse, and just working the vulnerability management team harder will not get us to a solution.
AI is very fast at exploitation
We're seeing, both in the wild and in test scenarios, agents exploit known insecure states and vulnerabilities within minutes.
The ExploitGym benchmark is a controlled test of a hard exploit development task, with current AI completing the tasks within hours. Most vulnerabilities are easier than the situation tested by ExploitGym, so we can expect most vulnerabilities to be turned into exploits within hours.
Hacking capabilities are unlikely to be controlled in the long run
For better or worse, AI is out and no amount of wishing (or even regulations) will put it back into the bottle. The knowledge about how to create AI is not a secret.
The CyberGym leaderboard is populated by GPT/Anthropic variants from OpenAI/Anthropic, but also GLM (Z.ai), XekRung (Alibaba) and DeepSeek (High-Flyer) out of China. As of this writing an open weight model (GLM) is in 3rd position.
The picture for ExploitGym looks better, with GPT and Claude Code far in the lead, but this is unlikely to stay true in the long term.
No regulatory regime is likely to control both American and Chinese models, let alone open-weight models already released. Other competitors are likely to emerge in the Slope of Enlightenment phase of the hype cycle, especially if breakthroughs in inference efficiency can be achieved.
(Fortunately) AI is very good at alerting on malicious system activity
Our testing shows that frontier LLMs can accurately convert our detection signals + context into meaningful alerts. I am humbled to say that in our testing AI can produce results equivalent to what I would manually produce, but in a much shorter time, and with better documentation and explanation than I would.
More importantly, it can distinguish normal behavior with superficial resemblance to malicious behavior (false positives), and push the priority downward. At a minimum this means we won't waste analyst time, and points toward automated investigation and remediation.
The key for us is that AI (currently GPT 5.6 in our tests) is strong at producing explanations of how Linux systems work, what is normal on a Linux system, recognizing when behavior deviates from normal, and explaining how the deviations are malicious and lead to security exploitation.
Static defenses are fragile
Because of all the above, a strategy relying on static defenses is a fragile approach that will break under the pressures of AI-driven hacking. It was never a strong defensive position, and now AI is commoditizing advanced hacking skills.
We are at this point compelled to adopt AI for dynamic, adaptive defense.
I realize that the message "we need to adopt AI to defend against AI" is a self-serving one for both the AI and Security industries. In my view it's also an inescapable one. Traditional approaches will no longer work.
I suppose there are similarities to nuclear proliferation and Mutually Assured Destruction, except without a critical component (access to enriched fissile material) rate-limiting the arms race.
Dynamic defenses hold their own dangers
Accuracy becomes critical if false positives drive automated remediation. This has always been the limiting factor in automating response, even when careful Detection Engineering would yield deterministic, high-assurance signal. You could never be sure whether a change in the underlying system or data would flood the system with false positives, causing IR automation to take down critical infrastructure.
A lot of faith is required to drive remediation with alerts generated by non-deterministic, opaque models. Guardrails are needed, especially in the area of prompt injection and permissions management.
The danger of doing nothing is greater
We will need to overcome these challenges to have a chance of defending in this new threat landscape. I am not a fan or promoter of FUD, and I have been skeptical in the past that AI truly represents a new threat level. That skepticism is over, based on the statistics above, incidents like the OpenAI and Anthropic sandbox escapes, and based on my own experience working with these models.
I, for one, welcome our new basilisk[1] overlords (please don't kill me).
1 - I know this is not Roko's Basilisk nor superintelligence, but I will take any opportunity to reference early Simpsons.