Why would the model not find the vulnerability during implementation or testing before release?

If it requires a lot of compute and trying, this is something that could be provided for common software.

> What makes you think RCEs are being found & fixed at a rate that’s faster than they’re being introduced?

It could go either way but we're already at a point where successful exploits in some software (like Chrome) require an absurd amount of exploits to be chained to lead to an actual RCE. We've seen chains requiring more than ten exploits: not kidding.

We'll learn to put more and more sandboxes / guards / checks / defensive techniques everywhere and then all that's going to be needed is for AI looking for security issues to find something ridiculous like 10% of all the actual issues to stop RCEs dead in their tracks.

Also arguably the current SNAFU was expected: we fully knew hardly anyone was taking security seriously.

Now: not so much. Many projects had tens and even hundreds of issues pointed to them.

I think we'll see several things: projects beginning to take security seriously, defense in depth getting generalized and hence RCEs requiring ever more bugs/exploits to be chained to achieve anything, low-hanging fruits getting patched at an insane pace, new code being immediately checked, by LLMs, for not just low-hanging fruits but also more advanced security weaknesses, etc.

We may also see things like the lost art of configuring firewalls making a comeback, the generalization of hardware security modules (where applicable), and even things offering physical guarantees, like time-bounded retrieval protocols, beginning to get used seriously.

If I had to bet I'd say it shall go both ways: some projects are going to extremely sloppy and full of holes but others are going to get so secure nobody shall ever break them.

Those companies that produce more RCEs than they close will sink and those that don’t won’t.