In April 2026, Anthropic announced a collaboration with several major technology and security firms to test an unreleased model on defensive cybersecurity work, and reported it had already surfaced thousands of vulnerabilities across operating systems, browsers and widely used software. Whatever becomes of that specific project, the direction is clear: AI-assisted vulnerability discovery is moving from research demo to standard practice.
Why defence is a natural fit
Finding bugs is pattern-matching at scale across enormous codebases — exactly the kind of tedious, high-volume analysis that models are good at and humans burn out on. An AI system can read every file, flag suspicious patterns, and draft an explanation of why something might be exploitable, leaving humans to judge severity and fix.
The double-edged part
The same capability helps attackers. The realistic expectation for the next few years is a faster loop on both sides — quicker discovery, quicker patching, and less time between a vulnerability becoming known and becoming exploited. Organisations that patch slowly are more exposed in that world, not less.
What to actually do
- Assume vulnerability discovery is accelerating and shorten your patch cycles accordingly.
- Use AI-assisted scanning on your own code before someone else’s tool finds the problem.
- Keep a human in the loop for triage — false positives at volume waste more time than they save.
Summary: AI-assisted security is not a product you buy once; it’s a faster clock everyone is now running on. The teams that stay safe are the ones that speed up their response to match.
#AI #Cybersecurity #AppSec #DevSecOps #SazkoSolutions