I do think we’re in a unique time, where software and software security are going to change and adapt. But that is also why this time will be stressful. Let me explain.

OpenAI released GPT-6 Cyber, and I think that in the past couple of weeks, we saw how frequent security issues are compared to the past. We had many high-risk CVEs and vulnerabilities being shared in the past couple of weeks, and that is concerning on many levels.

Because obviously, what PHP2Shell led to, for example, was some websites being taken down because they couldn’t trust the hosts. Some hosts, smaller hosts, were not able to ship the patch early or in time, or to mitigate before the release. The vulnerability was leaked, and that posed a big problem for people.

Most of these vulnerabilities were found through AI security tooling, which is not widely available yet, or at least not to everyone.

AI security tooling

OpenAI and Anthropic limit the people who can access these cyber capabilities to different levels. OpenAI provides Daybreak Blue and Daybreak Red, which are two levels. You can quite easily get Daybreak Blue to do some basic security vulnerability scanning, whereas for Daybreak Red, you need additional verification because that is the tooling that allows you to try to hack into things.

But Anthropic also shared how GLM-5.3 is top-notch for security research, and that is a concern on some levels because it is not restricted. Anyone could theoretically use it to find vulnerabilities and hack into systems.

I think this turbulence will last quite a while. It will last because we are now in the unique process of probably rewriting most of the software code that we have.

Rewriting software

AI is incredibly capable when we think about rewriting code. It’s something that I personally saw and experienced: things that years ago would have felt impossible to achieve for a team, let alone a single individual are now possible in hours or, in the worst case, days with AI.

This is absolutely new, and it allows us to rewrite entire codebases, to move them, to shift them, and improve them.

One of the things we can do today is create formal verifications of how our product works. Something that was missing before and that we didn’t feel the need for, but now, with hallucinations and everything related to AI, we want to have that kind of formal verification.

What this opens up is a hopefully temporary moment in the history of software where we will have a lot of vulnerabilities. Some of them will be found by AIs that are used in a good way, and some of them might be found or disclosed by attackers.

You should assume that everything can be hacked, everything can be broken into, and everything you own is at risk.

A new shape of security

Will it be like this forever? I don’t think so. I do think that this is a moment in time that will allow us to create a new kind and shape of security, a shape of security that didn’t exist before because we didn’t have the tooling that would allow us to go so deeply into codebases and use cases.

Now that AI can do this, and it can do this relentlessly, albeit with some token usage and power usage, this is possible.

It’ll be a matter of adapting each piece of software. As everything evolves, each piece of software will become increasingly secure, increasingly better, as long as there’s someone supporting it.

Open Source

This is also why open source software becomes even more important than ever, on two levels.

The first one is that you want open source software that’s widely supported, that has a community supporting it in the long term, that allows you to have software that will withstand the test of time.

You see so many clones of software because AI is good at doing this, but few of them, if any, will stand the test of time. What you want is something that’s supported, that has good security practices and good security disclosure practices, because that will help everything.

The second reason why open source software is important is that as AI evolves, you have a true way of understanding its security posture, something that you cannot quite easily get for closed source software because you don’t have access to it.

You can trust them, but you also know, by the staggering amount of emails that you receive about security issues and data disclosure, that closed source software is going to be attacked enormously in ways we didn’t expect.

Adapting to what comes next

I do think the software engineering world will be shaken in the next years because of AI and security research. I’m still not sure how everything will change, but I do think we’ll have a better security posture and that the way we do software will change in a way that has more security built in.

Until we get there, we need to adapt, and we’ll see software have a lot of vulnerabilities. Lean on open source: things that are verifiable, have good security practices, and have a community supporting them in the long term.

My take is that you should also be worried about single-person projects. Even though there are many projects owned by a single person, those become increasingly risky because a single point of failure can also lead to injection into your projects.

But, as everything changes, hopefully each piece of software will become increasingly secure and increasingly better.