The security world has two long-coexisting cultures.
One is "Responsible Disclosure": security researchers find a vulnerability, privately notify maintainers first, give them time to fix, then go public. This is the default code of conduct for ethical hackers.
The other is "Full Disclosure": publish vulnerabilities immediately, forcing maintainers to respond quickly. Supporters argue that leaving maintainers face is the only way to push security progress.
These two cultures have argued for twenty years but coexisted peacefully — because finding vulnerabilities took time and effort. Until AI tools started changing the game.
AI Makes Vulnerability Discovery Faster
This is not hypothetical. Multiple open-source projects have reported significant increases in vulnerability reports since AI coding assistants became popular.
The reasons are direct:
- A security researcher using AI-assisted code analysis can review in a day what used to take a week
- AI can automatically identify common vulnerability patterns (SQL injection, XSS, buffer overflows) for batch scanning
- The barrier for "amateur security enthusiasts" has lowered — you do not need years of experience to find low-hanging fruit with AI
The speed of vulnerability discovery is accelerating. But what about the speed of fixes?
The Fix Side Is Also Using AI
Good news: project maintainers are also using the same AI tools to accelerate fixes.
After receiving a vulnerability report, maintainers can let AI assist in analyzing impact scope, generating patches, and writing regression tests. For simple vulnerabilities, the time from report to fix release has shrunk from days to hours.
Bad news: this acceleration is asymmetric.
Finding a vulnerability is typically easier than fixing it. AI helps locate the problem quickly, but fixes need to consider compatibility, regression risk, and test coverage — areas where AI currently does not help much.
So the overall trend is: more vulnerability reports, but fix speed cannot keep up.
The Collision of Two Cultures
When vulnerability reports surge, the "Responsible Disclosure" culture comes under pressure.
Maintainers receive dozens of vulnerability reports daily, most of them low-severity. They do not have enough time to handle them one by one — let alone follow the responsible disclosure process of keeping quiet before a fix.
The result: some researchers are choosing to go public directly. Not because they are unethical, but because maintainers are simply too busy, and waiting might mean never getting a fix.
This in turn makes maintainers more overwhelmed — public vulnerabilities attract more attackers, increasing the urgency of fixes.
A positive feedback loop forms: AI accelerates discovery → report volume explodes → maintainers overwhelmed → more direct disclosures → larger attack window → greater fix pressure.
What This Means for AI Agent Security
If you are building AI agents, this trend matters more than you think.
AI agents are essentially automated systems that execute code, access networks, and manipulate data. Every one of these operations can become an attack surface. When vulnerability discovery speed exceeds fix speed, agent security risks also rise.
Especially when agents use third-party tools, MCP servers, and open-source libraries — the security of these components directly determines the agent's security boundary.
Practical Steps
Narrow the attack surface. Agents should only load necessary tools and capabilities. Do not give an agent an all-powerful permission set and pray it will not be exploited.
Update dependencies quickly. When a library your agent depends on has a security update, upgrade promptly. AI accelerates fixes, but only if you apply them.
Monitor vulnerability advisories. Subscribe to security advisory lists for your core dependencies. GitHub Security Advisories can automatically alert you to known vulnerabilities.
Security is not a problem to solve but a continuous process. AI has accelerated the pace of this process — both discovery and fixing. Keeping up with the pace is more practical than searching for a perfect solution.
Sources
- Jeff Kaufman: AI is breaking two vulnerability cultures
- Hacker News discussion (310 points, 128 comments)