AI Attacks Outpace Defense: The Security Asymmetry

AI has learned to attack before it learned to defend. This is due to a testing asymmetry in security. It's much easier to prove an offensive AI works than a defensive one. For example, Anthropic's Claude Mythos model found over 10,000 high- or critical-severity flaws in software. 90.6% of these findings were valid. OpenAI's GPT-5.6-Cyber model achieved roughly 95% success in advanced offensive security tasks. The bottleneck has shifted from finding flaws to fixing them. A typical high-severity bug can take about two weeks to patch. This situation impacts vendors, investors, and practitioners alike, highlighting a critical gap in AI's security development.