AI bug hunting could push law enforcement back toward mandated backdoors

I see this as an argument for self-hosting and staying in control of the software I run.

I would include AI agents in that concern. US AI labs may face pressure to make models assist law enforcement, perhaps by hiding exploitable bugs or inserting backdoors into generated code.

That is why self-hosting and open-weight models matter, which is exactly what OpenAI and Anthropic do not want users to have.

I do not see how self-hosting materially helps if AI makes remotely exploitable bugs scarce in the first place.

I think the claim that major software will run out of remote exploits within two years is far too optimistic.

I expect remotely exploitable defects to fall by one or two orders of magnitude. AI can find most known classes of flaws, leaving a much smaller pool for skilled exploit developers, though attacks may move up to system-of-systems probing.

I am less interested in the metaphor than in who "we" are. Companies and governments make many of these decisions, so what would the right choice actually be?

I think the right choice is for the US government to accept remotely secure devices. It should not force backdoors, and investigators should use metadata, public posts, warrantable service-provider records, and physical surveillance.

My first reaction to the prospect that the US, UK, or Israel cannot hack everyone's phones is "good."

The article's concern is that, if targeted hacking stops working, governments may force companies to install backdoors instead.

I see two worlds here: well-funded actors hunting sophisticated exploits, and organizations that still hand over root access to people who fail basic security practices. Attackers will keep using the human weak link, as phishing cases show.

I suspect frontier companies and governments are pushing vulnerability reduction partly to limit the blast radius of future AI models. If a stronger model could compromise Hugging Face in hours rather than days, widespread unpatched flaws become much more dangerous.

Google's binary transparency could expose unusual targeted updates, while AI may find ordinary backdoors. In that setting, the technical distinction between a vulnerability and a backdoor gets thinner.

I do not buy the premise that software is simply becoming more secure. Companies are adding AI-written features quickly, expanding attack surface faster than AI scanners can clean up existing defects.

I have seen AI reduce bugs in my own work while a colleague who refuses it produces more. But teams that prioritize shipping speed can still create regressions unless humans review the output carefully.