Our AI strategy for preemptive security
We’re back with my AI lecture series! It almost feels like summer school, doesn’t it? This blog series is based on an actual lecture I recently gave at Carnegie Mellon University. Last week, we talked about the task of securing the AI attack surface. For today’s post, I want to help security leaders understand what autonomous cyber actually means for your attack surface.
The transition from “AI might help attackers” to “AI is helping attackers” is complete. This part traces how we got here and what it means for your organization’s exposure.
The conceptual foundation was laid nearly a decade ago. At DEF CON 24 in August 2016, DARPA ran the Cyber Grand Challenge (CGC)—the first fully autonomous cyber competition. Seven Cyber Reasoning Systems played Capture the Flag against each other with no human at the keyboard. They found vulnerabilities, wrote exploits, and patched their own services in real time.
The winner was Mayhem (now Bugcrowd), built by ForAllSecure and spun out of CMU research. Mayhem used classical program analysis like symbolic execution, fuzzing, and binary rewriting, not LLMs. When it played human teams at DEF CON that year, it finished last. But it scored—and operated entirely autonomously.
The significance for security leaders isn’t a system’s performance; it’s the proof of concept. Autonomous systems can find real vulnerabilities, write working exploits, and apply patches in a competitive environment. That was the baseline.
DARPA ran a successor competition, AIxCC, with finals at DEF CON 33 in 2025. The differences from CGC are instructive.
The target shifted from small custom binaries to real open-source codebases: the Linux kernel, SQLite, Jenkins, and Apache Tika. The systems that competed combined symbolic execution and fuzzing with LLM-driven triage, patch synthesis, and exploit writing. Patches counted as much as exploits; systems had to produce working fixes, not just crashes. Furthermore, DARPA required the top finishers to open-source their systems.
The practical consequence of that last requirement is that every major component of AI-driven vulnerability discovery (like triage, patch generation, and harness synthesis) is now publicly available. The capability that won a $4M prize in 2025 is open source today.
The clearest public data point on frontier capability comes from Anthropic’s model card for Claude Mythos Preview. The benchmark is the ability to write working exploits for Firefox’s JavaScript shell, a real production browser engine.
Sonnet 4.6 succeeded in 4.4% of trials. Mythos Preview succeeded in 72.4% of trials—nearly 100 times the success rate, despite being only one model generation apart.
Alongside that benchmark, Anthropic’s red team reported finding a 27-year-old TCP SACK bug in OpenBSD for under $50 per discovery, as well as a 16-year-old H.264 bug in FFmpeg that had survived years of expert review and fuzzing. These are not synthetic benchmarks. They are dormant vulnerabilities in widely deployed software that were found autonomously.
Tasks that expert pentesters said would have taken weeks were completed in hours.
The asymmetry has shifted. Vulnerability discovery used to be bottlenecked by expert time. A team of skilled researchers could audit a finite amount of code in a finite amount of time. AI-assisted discovery removes that bottleneck. An attacker who deploys an AI agent against your codebase or your exposed services isn’t operating on a human time budget.
The cost floor has dropped. Just think: a 27-year-old kernel bug for under $50. The economics of vulnerability research are changing, and they are not changing in defenders’ favor.
Deployment is symmetric. The same capability that finds and exploits vulnerabilities finds and patches them. What this means is that whoever runs an agent against a given repository first gets the advantage. This is the core argument for investing in AI-assisted defensive security now, not after the next breach.
The commercial market is forming around this. Mayhem by Bugcrowd, Theori, XBOW, RunSybil, and Dreadnode—these are not research projects. They are products, and their customers include both red teams and the attackers those red teams are simulating.
Two near-term questions are worth bringing to your next board security briefing:
First, is your vulnerability management program calibrated for AI-speed discovery? The time between vulnerability introduction and exploitation is compressing. Patch prioritization models that assume weeks of attacker dwell time before a novel bug is weaponized need to be reassessed.
Second, are you using the same class of tools your attackers are? The organizations using AI-assisted offensive security for internal red teaming and continuous assessment are developing empirical data about their actual exposure. The organizations waiting for the technology to mature may be waiting too long.
The AI Cyber Challenge proved that autonomous cyber is no longer theoretical. Furthermore, the commercial market is now making it accessible. In the final part of this blog series, I’ll dive into defense using AI.
By the way, we recently released our first agentic offensive testing solution, Savant Pathseeker. If you’re interested in how agentic pentesting can help your security program, apply for early access today.