PHP RCE bugs found by GPT-5.6 and Gemini 4 hit 70% of the internet, exploited before the patch landed

This isn't the new normal, it's a transition period. A superhuman developer just entered the scene and is clearing out years of backlog, and once most code is written by these systems the tide of critical findings will slow down. Could take a while though.

Not sure that follows. Every time AI writes code and then audits it, it still finds bugs. Models take shortcuts to hit goals, and once a human has the finished product they often skip the audit step entirely, so "AI can find bugs" doesn't imply "AI writes bug-free code."

+1, there aren't an infinite number of serious vulnerabilities out there. And good luck to the NHS closing everything up, these agents are already strong at decompiling and they'll be strong at fuzzing too.

I wouldn't tempt fate by predicting a slowdown in finding vulnerabilities.

Is NHS code mostly client-side or are they still shipping binaries? Server-side code that never leaves the building can't be decompiled, so the exposure may be much smaller than people assume.

Everything I've read says yes, this is the new normal. When Mythos was announced, basically every security person I talk to freaked out, and a real chunk of my job now is mitigating AI-generated exploits. Piling up more AI-generated code makes it worse, since that code is notoriously bad at security.

Just use AI to test your AI code. What a wonderful new world.

Most of the security people I know weren't seriously worried about Mythos, the fear came from vendors selling cyber products. The real losses come from LLMs doing basic OSINT and writing convincing emails and voice or video, and nobody talks about it. Hearing about zebras and unicorns while 10 billion ants walk into houses a year gets old.

Is AI code actually notoriously bad at security? My experience is the opposite, it's extremely defensive and avoids obvious mistakes. Are we talking about older models here or Mythos-class ones?

"New normal"? Is that phrase back again? It got pushed pretty hard in 2020.

More than the code quality, a lot of developers just stopped reading the code and trust the bots. I've seen botched auth implementations, rolled-back security fixes, and falsified benchmarks this week alone, all in hyped projects. Do not blindly trust AI output.

That was true in the past, but AI is also surfacing exploits that have sat in human-written code for years. We're seeing fewer customer-reported issues and passing every pen test, and friends in security and ops tell me the same.

Shouldn't continuous pen testing just be standard by now?

"Vaccines cause autism" was a widely believed thing too. Can you point at anything specific that makes you confident AI code is worse at security?

Explain the asymmetry you're claiming: a model can find faults and write exploits against a system, but can't avoid those same faults when writing it? Seems like you could just prompt for the attacks you want defended against.

Let's not forget the AI industry built the technology and infrastructure for this whole security nightmare, and none of it was inevitable. At every step the leadership chose things that made these threats more likely.

That doesn't match what we're actually seeing. The vulnerabilities being exposed right now are six years old and weren't written by AI slop. Security has always been attacker versus defender symmetry, so if the attacker has an LLM the defender does too.