This Is Not Sustainable: On Cybersecurity and AI

The author argues that vulnerability discovery has fundamentally changed while disclosure processes are broken, citing a single week that brought the PwnEscape virtualization escape, the eMudhra CA compromise, the php2shell PHP flaw, and the brotli RCE affecting far more than Node.js. They contend that having a fix is not the bottleneck—attack surface enumeration, inventory, and safe deployment are—and that AI cannot solve this, since AI-generated reports are too verbose and AI patches often fail or introduce new flaws. With incident responders burning out, the piece concludes that limiting blast radius and assuming compromise are the only realistic options.