Security through obscurity, the long-discredited practice of relying on hidden implementation details to protect systems, has finally run out of places to hide. AI agents are now routinely finding vulnerabilities that defenders thought were buried deep enough to never matter, and the pace of discovery is outstripping the industry's ability to fix what they find.
A decade of testing means nothing when AI reads every line
The premise behind security through obscurity was always simple: if attackers don't know how a system works, they can't exploit its weaknesses. It was never considered a legitimate security strategy by serious practitioners, but many organizations depended on it anyway, whether by choice or because they lacked the resources for proper hardening. That shelter is gone.
Brett Leatherman, assistant director of the FBI's Cyber Division, described the scale of the shift in concrete terms. Open source libraries that the community has stress-tested for a decade, components running on 80 percent of web servers, projects that experienced developers considered solid, are now falling to modern AI models. These aren't new libraries with obvious oversights. They're mature, widely deployed codebases that countless human reviewers had already examined.
The same models are also finding vulnerabilities in components nobody has thought about in years. Dustin Childs, chief bug hunter at Trend Micro's Zero Day Initiative, pointed to Microsoft's record-breaking September Patch Tuesday, which addressed 974 CVEs. Among the patched items: the Telnet client, Windows RNDIS USB networking, NFS Portmapper, and Link Layer Topology Discovery, a Vista-era protocol. These are components that defenders assumed were either deprecated or too obscure to warrant attention.
Attackers are closing the patch gap to hours
Finding the vulnerabilities is only one side of the equation. Attackers are using the same AI capabilities to reverse-engineer patches and develop exploits within hours of disclosure. In one documented case, at least four espionage groups, most with suspected ties to China, exploited an open source Chromium vulnerability using an exploit kit developed shortly after maintainers released an upstream patch but before downstream stable releases reached users.
The traditional patch gap, the window between a fix being available and users actually deploying it, has effectively collapsed. What used to be weeks or months of relative safety after a patch dropped is now a race measured in hours.
Industrial control systems face a new threat model
The implications extend well beyond conventional IT infrastructure. Operational technology systems, the industrial controllers that manage power grids, water treatment plants, and manufacturing facilities, have historically relied on obscure protocols and proprietary hardware as a de facto security layer. These systems were black boxes to most attackers simply because the expertise required to understand them was rare.
AI eliminates that scarcity. John Hultquist, chief analyst at Google Threat Intelligence Group, expressed concern that criminals no longer need deep OT expertise to carry out destructive attacks. They can instruct an agent to learn the target system and execute the attack for them.
This is no longer theoretical. Five US government agencies recently disclosed that attackers used AI-generated exploitation scripts to compromise internet-exposed Siemens S7 Series programmable logic controllers at water, manufacturing, and energy facilities. The agencies described it as an active threat, not a hypothetical risk.
Hultquist noted that AI can guide an attacker through application layers, operating systems, and even firmware, making previously specialized knowledge readily available to anyone willing to ask for it.
Finding bugs was never the hard part
Katie Moussouris, founder and CEO of Luta Security, drew a distinction that reframes the entire discussion. Finding vulnerabilities has never been the core security problem. The bottleneck has always been triaging, prioritizing, and actually getting fixes deployed.
AI is now shining an intense light on the discovery side of security while leaving the defensive side largely untouched. There is no equivalent automation for patching, remediation, or process improvement at scale. The result is a growing imbalance: more vulnerabilities found, faster, with no corresponding increase in the capacity to address them.
The numbers support this concern. A study by 1Password's security research team produced 6,080 patches across six CVEs using two frontier models. The average success rate for generating a patch that fully resolved the vulnerability without changing application behavior was 26 percent. Even patches that did fix the flaw also broke application behavior 20 percent of the time. Over 53 percent of the generated patches either failed to resolve the issue, introduced new vulnerabilities, or both.
A separate Veracode analysis across more than 100 models and 80 coding tasks found an average security pass rate of 56 percent for AI-generated code.
The treadmill will kill you
Moussouris warned that organizations treating this as a resource problem, throwing more people at finding and fixing individual bugs without addressing why the bugs exist, are on a path to exhaustion. The volume is already too high and growing too fast for that approach to scale.
Her prescription is a shift toward measuring patterns in vulnerability types rather than raw counts, then using those patterns to drive process improvements. If a team keeps seeing injection flaws, the fix isn't faster patching. It's safer templates in the CI/CD pipeline, implemented once and preventing that class of vulnerability at scale.
The organizations that survive this phase won't be the ones that find the most bugs. They'll be the ones that stop creating them in the first place.