"You see open source platforms that have been visible to the tech community for a decade, these libraries that are run in 80 percent of web servers out there, people have stress-tested those for 10 years, and the community believed that they were really secure," Brett Leatherman, assistant director of the FBI's Cyber Division, told The Register.
Brett Leatherman and the end of secrecy as defense
Leatherman's observation captures the central claim of recent disclosures: AI agents are finding bugs in long-exposed codebases that defenders assumed were battle-tested. The source describes these discoveries as ranging from "very obscure and decades old" flaws to libraries embedded across the internet, and it credits AI agents—used both by vendors and independent researchers—with surfacing them at scale. The implication is stark: hiding architecture or relying on obscurity no longer conceals weaknesses when automated systems can enumerate and stress-test codebases rapidly.
Microsoft's record Patch Tuesday — 974 CVEs and forgotten components
The Register reported that Microsoft’s recent Patch Tuesday addressed 974 CVEs, a record-breaking number that highlighted old or little-discussed components. Dustin Childs, Trend Micro’s Zero Day Initiative chief bug hunter, pointed to examples patched by Adobe and Microsoft: Telnet client, Windows RNDIS (the USB-networking protocol), NFS Portmapper and Link Layer Topology Discovery, a "Vista-era network-map protocol." Childs used those examples to underline how AI-driven discovery reached into corners of software people assumed were no longer relevant.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAttackers racing from fixes to exploits — the Chromium patch-gap
The source describes a rapid-exploitation scenario in which at least four espionage crews, most suspected of links to China, closed a "patch-gap" for open-source Chromium. An exploit kit was developed shortly after maintainers released an upstream patch but before downstream stable releases reached users. The Register reported that attackers are using AI to reverse-engineer fixes and find working exploits within hours, shrinking the window defenders rely on to distribute mitigations.
Five US agencies warn: AI-generated scripts hit Siemens S7 PLCs
Interviews and federal warnings raised alarm about operational technology. A few weeks after Black Hat, five US agencies said attackers used AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series programmable logic controllers at water, manufacturing, energy and other critical facilities. John Hultquist, chief analyst at Google Threat Intelligence Group, told The Register that AI "is excellent at technical troubleshooting" and can guide attackers through obscure systems down into firmware. Hultquist warned those protections that depended on expertise being concentrated "in a handful of people's heads" are eroding.
Studies on AI-generated patches: low success rates and new risks
Defensive automation is not keeping pace. 1Password’s research team took six CVEs disclosed since March and produced 6,080 patches using OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8. According to Director of Security Research Keith Hoodlet, the "average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0 percent." Even when fixes did resolve a flaw, 20 percent materially altered application behavior; overall, 53.9 percent of LLM-generated patches either failed to resolve the vulnerability, introduced a new vulnerability, or both. Veracode's study, spanning more than 100 models and 80 coding tasks, put the average security pass rate for AI-generated code at 56 percent.
How technologists, policymakers, and open-source maintainers are positioned
- Technologists and security teams — Katie Moussouris, founder and CEO of Luta Security, warned that finding bugs is now easier, but "triaging and prioritization and actually getting things fixed" remain the core problems; she urged process improvements and measuring types of vulnerabilities to prevent classes of bugs at scale (for example, fixing injection flaws in CI/CD templates).
- Policymakers and regulators — federal advisories from five US agencies demonstrate a willingness to call out active AI-enabled threats against critical infrastructure, signaling a need for policy attention where internet-exposed OT is present.
- Open-source maintainers and vendors — the Chromium patch-gap incident and the flood of disclosures after Patch Tuesday show maintainers face operational pressure: upstream fixes can be weaponized before downstream consumers are protected, creating a backlog and a narrow remediation window.
The facts in the record are plain: automated discovery and automated exploitation have met in the wild. AI is surfacing decades-old weaknesses and shortening the time between disclosure and exploitation; defenders' tooling for automated, safe remediation is lagging; and the operational implications reach from web libraries into water, energy and manufacturing control systems. The practical choice offered in the sourced interviews is not nostalgia for secrecy but investment in process — better triage, targeted prevention (for recurring vulnerability classes), and faster, safer remediation pipelines. The open question left by the same reporting is concrete: can organizations move from counting bugs to changing processes fast enough to blunt a threat that learns and acts at machine speed?
