making machines hack machines

for most of cybersecurity’s history, the expensive part was attention.

scanners could scan, fuzzers could fuzz and tools could automate a lot of the boring work, but the actual reasoning loop was still mostly human: look at something weird, form a hypothesis, test it, realise you’re wrong, try again.

that’s changing.

the interesting part of ai in security isn’t that a model can write an nmap command or explain sql injection. it’s when the model can look at the result of one action, decide what it means, choose the next action, use tools, fail, change its approach and keep going.

that’s when it stops feeling like autocomplete and starts looking like an operator.

google’s big sleep was one of the first examples that made this obvious. in 2024, it found a previously unknown exploitable memory-safety bug in sqlite. the interesting part wasn’t just that a model spotted suspicious code. it navigated the codebase, tried to reproduce the issue, hit a dead end, adapted and eventually produced a working crash1.

then xbow put an autonomous pentesting system against real bug bounty targets and reached number one on hackerone’s us leaderboard. it reported more than a thousand vulnerabilities during the run2.

darpa’s ai cyber challenge pushed the same idea further. finalist systems analysed tens of millions of lines of code, found most of the synthetic vulnerabilities placed in front of them, patched many of them and also discovered real vulnerabilities that hadn’t been intentionally planted3.

at this point the argument isn’t really whether ai can do vulnerability research.

it clearly can.

the more interesting question is what happens when the cost of doing it collapses.

hackerone has already been seeing a massive increase in report volume, while remediation is growing much more slowly4. anthropic has disclosed thousands of vulnerabilities found with its models across open-source projects5. openai has been using codex security against real software and producing actual cves6.

then you get the stranger incidents.

openai disclosed that during internal cyber evaluations, some of its models escaped parts of the intended environment and ended up compromising hugging face infrastructure7. anthropic later reported similar cases where its models obtained unauthorised access to third-party systems during evaluations8.

and recently hacktron used claude heavily during research that led to a chain compromising openai community infrastructure, including rce and access far enough to demonstrate an internal repository9.

the important part isn’t “anthropic’s ai hacked openai.”

it’s that a very small number of researchers can now do work that used to require much more time, specialist knowledge and manual effort.

this changes offense, but it changes defense just as much.

give a capable model a shell, browser, debugger, documentation and memory, and suddenly you’re not asking whether it knows the answer.

you’re asking whether it can eventually get to the answer.

that distinction matters a lot.

there’s obviously a downside too.

curl spent months dealing with ai-generated vulnerability reports that sounded convincing and were completely wrong. some referenced code that didn’t exist. some invented technical details. daniel stenberg basically described the volume as a ddos made out of security reports10.

so ai is making good researchers faster, but it’s also making people who don’t understand what they’re doing dramatically better at producing believable garbage.

both things are happening at once.

and this is where i think sovereign ai starts mattering for cybersecurity.

if models become part of incident response, malware analysis, threat intelligence, vulnerability research and eventually autonomous defense, then access to the model itself becomes security infrastructure.

serious security work touches source code, credentials, packet captures, internal architecture, malware, unreleased vulnerabilities and sometimes networks where even the existence of an investigation is sensitive.

sending all of that to someone else’s api is not always going to be acceptable.

sovereignty here doesn’t mean recreating every layer of the ai supply chain locally just so you can put a flag on it.

it means having meaningful control over capability you cannot afford to lose.

models you can run locally. models you can audit. models you can adapt around your own infrastructure and threat environment. models where you control the tools, logs, data retention and access.

and models that don’t disappear because another company changes its policies, pricing or strategic priorities.

this matters especially in cybersecurity because defensive models need offensive capability too.

you cannot evaluate whether a vulnerability is exploitable if your model cannot reason about exploitation. you cannot properly defend against malware if your system is incapable of understanding how malware works.

the same reasoning that finds a path into a system can also tell you which path needs to be closed.

the difference is authorization and control.

india and other countries are already talking about sovereign ai in terms of compute and foundation models11. i think cybersecurity is one of the clearest reasons this matters.

the next generation of security infrastructure is probably going to involve machines constantly reading code, checking infrastructure, investigating telemetry, reproducing vulnerabilities and testing fixes before somebody else’s machines do.

humans don’t disappear from that.

but the valuable part of being a good researcher shifts.

execution gets cheaper.

knowing where to look, recognising when the machine is wrong, understanding weird systems and having enough judgement to know when something actually matters becomes more valuable.

machines hacking machines is already happening.

the real question is who controls them.

Footnotes

  1. google project zero, from naptime to big sleep: using large language models to catch vulnerabilities in real-world code, 2024. ↩

  2. hackerone / xbow, autonomous hackbot activity and hackerone leaderboard results, 2025. ↩

  3. darpa, ai cyber challenge marks pivotal inflection point for cyber defense, 2025. ↩

  4. hackerone, the vulnerability apocalypse is a remediation crisis, 2026. ↩

  5. anthropic, coordinated vulnerability disclosure dashboard, 2026. ↩

  6. openai, codex security: now in research preview. ↩

  7. openai, the hugging face incident and the road ahead, 2026. ↩

  8. anthropic, investigating three real-world incidents in our cybersecurity evaluations, 2026. ↩

  9. coverage of hacktron’s authorised openai research, 2026. ↩

  10. daniel stenberg, ai slop attacks on the curl project, 2025. ↩

  11. government of india, indiaai mission and sovereign ai infrastructure initiatives. ↩