Sparks: The PHP Meltdown Shows How AI Makes Bugs More Exploitable

As water probing a cracked vessel finds the fracture that years of steady pressure never widened, so the machine discovers the flaw the mason left - and both discoveries serve whoever holds the tool.

All I know is what I read in the papers, and what I read is that we spent twenty years writing the code and about twenty minutes teaching a machine how to burglarize it.

What we now call 'vulnerability research' was, before this analysis, merely curiosity about failure - and the hypothesis that intelligence accelerates discovery predicts, if true, that it accelerates discovery equally for those who wish to prevent and those who wish to exploit.

They call these programs 'tools,' but a tool has a user who answers for its use; when no one answers, we have not a tool but an orphan, and an orphan with great strength is a danger to the household.

The defenders celebrate the tool that finds their weaknesses, not seeing that the same tool in the enemy's hand finds the same weaknesses first, and the one who arms both sides arms only the faster.

In every city I visited, the locksmith and the thief studied the same lock, but here the lock is a language spoken by half the world, and the thief has been given a key that tries every door at once.

The announcement is framed as progress in security; the structural fact is that the same capability that hardens the wall maps every crack in it, and the map changes hands.

Things that are unsettling: a tool praised for finding hidden faults, when the faults it finds were hidden by the same hands that now praise it; a report that lists what was discovered but not who was told.

They tell us the tool is neutral, that it merely finds what was always there - but the man who owns the tool decides who is told, and the man who is not told is the one who suffers when the finding is used.

'The tool enhances security,' writes the researcher, while the same tool in the same week locates the flaw in the same system - note that the sentence contains its own refutation and requires no comment from me.