Gergely Orosz on the Implications of AI for Software Security

X postGergely OroszOpinion

Gergely Orosz outlines five major shifts in software security driven by AI, arguing that defense must automate patching and heavily adopt AI tooling despite rising costs.

Key points

  1. CVE vulnerability discovery has accelerated by roughly 10x to 100x.
  2. Manual patching must be phased out, though viable alternatives pose implementation challenges.
  3. Security monitoring requires significant enhancements.
  4. Defenders will have to deploy far more AI, which will dramatically increase security spending.
  5. Leading AI labs need to provide defenders with state-of-the-art models that do not refuse security tasks, or defenders will shift to open models.

Why it matters

The exponential speed-up in vulnerability discovery closes the defensive response window. Organizations relying on human-driven patch cycles and traditional monitoring risk being overwhelmed.

Analysis

Orosz highlights an emerging operational friction: offensive research benefits rapidly from automated scanning, while defenders often run into guardrails where commercial models refuse to process security-sensitive tasks. Unless leading providers ease restrictions for legitimate defensive workflows, organizations will likely pivot toward open-weight models to match attacker capabilities.

Original post

Gergely Orosz

@GergelyOrosz · 22 October 2026

Implications of AI, in relation to software security: #1 CVE discovery sped up ~10-100x vs before #2 Manual patching needs to die... but how? #3 Security monitoring needs to improve massively #4 Defenders will need to use a LOT more AI #5 Security will cost a LOT more

450 likes68 replies116 bookmarks28.8k views

View on X
More posts in the thread (1)
  1. @danpdc so either leading AI labs offer defenders SOTA AI that does not refuse to do this work, or defenders move to open models that don't refuse (that attackers probably use anyway!)
Selected replies (5)
  • @danpdc @GergelyOrosz The problem with defenders using AI is that the SOTA models refuse to perform any meaningful security work. On one hand I understand it (current events are a good example), but on the other hand it's difficult to move so fast in these circumstances.
  • @polydaic @GergelyOrosz #6 security is going to have to become a core competency of any company that exposes their systems to the internet
  • @ClaudiuDP @GergelyOrosz An idea for #2: t.co/njCem9gklc
  • @poiThePoi @GergelyOrosz The intersection of point 2 with SOC2 is going to be interesting. Because it's going to be 1. Setup Dependabot or Renovate (or homegrown versions of same) 2. CI tests run 3. If CI merged, auto-approve 4. If not, go get an agent 5. If really not, go get a human
  • @RaghavMehtaM1 @GergelyOrosz #2 is the hard one. auto-updating deps is also how you pull in a backdoored release at 3am

Mentioned links

Summary generated by AI (Gemini 3.8 Flash, 27 October 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Article:Etiido Uko

    Linux Kernel Approaches 2,000 CVEs per Release Amid AI Bug-Hunting Influx

    The growing use of AI tools for static code analysis is pushing the number of CVE fixes in the Linux kernel to unprecedented levels. Maintainers are struggling under a flood of submissions ranging from verified vulnerabilities to hallucinations and trivial clean-ups, prompting the removal of legacy drivers and the deployment of AI-based patch filtering.

    AI & LLMs· News

  • Article:The Cognition Team

    Cognition Introduces Devin Security Swarm

    Cognition has launched Devin Security Swarm, a multi-agent system designed to identify, validate, and remediate codebase vulnerabilities. Instead of merely surfacing static alerts, the system verifies exploitability in runtime sandboxes and automatically generates remediation pull requests.

    AI & LLMs· Announcement

  • X post:Tibo

    OpenAI Releases Codex Security CLI and TypeScript SDK

    OpenAI has open-sourced Codex Security, a tool designed to discover, validate, and remediate vulnerabilities in codebases. It provides a CLI, a TypeScript SDK, and support for multiple model providers.

    5.6kbookmarks736.6kviews

    AI & LLMs· Tool

  • Article:Gergely Orosz

    Inside OpenAI’s agentic software factory

    Gergely Orosz provides an inside look at OpenAI, where Codex and ChatGPT Work have transformed internal operations, shifting workflows away from IDEs to autonomous coding agents while a tenfold increase in PR volume forces a rethink of CI/CD.

    AI & LLMs· News

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.