AI bug hunting ends the era of security through obscurity

Security through obscurity — the idea that a system stays safe as long as its design and weaknesses remain hidden — no longer holds, according to interviews published by The Register on 13 September 2026. Software vendors and independent researchers are using AI agents to find bugs across products and open source code, producing record numbers of disclosures and patches, and a large backlog for project maintainers.

Brett Leatherman, assistant director of the FBI's Cyber Division, told The Register that open source libraries running on a large share of web servers, which the community believed were secure after a decade of scrutiny, were broken by the latest models, which reported significant vulnerabilities.

Dustin Childs, who leads bug hunting at Trend Micro's Zero Day Initiative, said the question was no longer a matter of opinion. He spoke the day after a Microsoft Patch Tuesday that addressed 974 CVEs. Childs said the components patched by Microsoft and Adobe included ones nobody had discussed in years, naming the Telnet client, Windows RNDIS USB-networking, the NFS Portmapper and Link Layer Topology Discovery, a network-mapping protocol dating to Windows Vista.

Attackers are moving quickly too. The Register reported that at least four espionage crews, most suspected of links to China, used an exploit kit built shortly after Chromium maintainers released an upstream patch but before the downstream stable release reached users, closing the so-called patch gap.

The concern extends to operational technology, the systems that run power, water and fuel supplies. John Hultquist, chief analyst at Google Threat Intelligence Group, told The Register that these systems have largely been protected because the expertise sat in a handful of people's heads, and that this will not last. AI, he said, is good at technical troubleshooting and at navigating obscure systems, and can guide attackers through the application layer, the operating system and firmware. Former US National Cyber Director Chris Inglis raised similar worries in interviews at Black Hat in August.

The risk is already being realised. The Register reported that five US agencies said attackers used AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series programmable logic controllers at water, manufacturing, energy and other critical facilities. "This is not a theoretical risk — it is an active threat," the agencies warned.

Katie Moussouris, founder and chief executive of Luta Security, said obscurity was never a winning strategy, because anyone who turns their attention to an organisation will find what is there. AI removes the skills barrier, she added, because a model has ingested everything and can help an attacker enumerate weak spots in an unfamiliar technology stack.

Her bigger point is that finding bugs was never the hard part. Triage, prioritisation and actually shipping fixes are, and defensive AI has not caught up. Two studies cited by The Register support that. 1Password's research team took six CVEs disclosed since March and generated 6,080 patches using OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8. Director of Security Research Keith Hoodlet wrote that the average success rate for a patch that fully resolved the vulnerability without materially changing behaviour was 26.0 per cent, and that patches failed to fix the flaw, introduced a new one, or both, 53.9 per cent of the time. Even successful patches altered application behaviour 20 per cent of the time, including flipping allow-list logic to deny-list logic. Veracode found an average security pass rate of 56 per cent for AI-generated code across more than 100 models and 80 coding tasks.

Moussouris said organisations that respond only by throwing resources at finding and fixing bugs, without examining the process failures that produced them, will "die on the treadmill". She argued for looking at vulnerability types and patterns that point to process improvements, rather than counting bugs and fix speed alone.