AI will never solve 90 percent of cybersecurity
AI coding tools are creating more flaws to exploit, while attackers and defenders both use AI to keep outdoing each other.
20VC with Harry Stebbings · Mercor Head of Product on Revenue Concentration from Frontier LabsArtificial intelligence will never finish the job of computer security, because in security the finish line keeps moving.
Oswald Nitski, head of product at Mercor, an AI data and evaluation company, says we are likely entering a period of sharply rising cyber threats. Tools that let anyone generate software quickly are producing a huge amount of AI-written code, which in many cases has holes. The threat, he says, will grow more than people expect.
The reason is how security works. Most office work is what Nitski calls sufficiency work. You update a customer database and you are done. There is a clear standard for good enough.
Security is the opposite. It is adversarial, meaning there are thinking opponents on the other side. Nitski describes these as AlphaGo-type situations for cyber offense and defense, with uncapped rewards and a constantly moving field.
That back-and-forth is why demand for defensive data and testing is rising so fast. In his account of the cat-and-mouse game, every defensive gain invites an offensive response.
So unlike routine business tasks, where by one measure 90 percent can already be completed, security will never settle at 90 percent. Each side moves the goalposts, and the contest starts over.
Questions people ask
Why does AI-generated code have more security holes?
They reuse unsafe patterns, skip checks on user inputs, or leave private data exposed. When beginners publish that code without review, it gives attackers many more easy targets.
What does the cat-and-mouse game look like in practice?
As general background, an attacker might use AI to scan thousands of programs for a known flaw and write a custom break-in, while a defender uses AI to spot strange activity and block it. When one side learns a new trick, the other studies it and updates its tools.
Do defenders ever get ahead for long?
As general background, a strong new defense can block current attacks for months or years. But attackers keep testing it, find a workaround, and force a new round of defenses, so no lead is permanent.