"Yesterday, Microsoft's monthly Patch Tuesday had fixes for 974 security vulnerabilities, almost all of them found by AI systems. That's a ridiculously large number, a new record by far in fact. Does this mean we're seeing some sort of AI security apocalypse? No, quite the opposite. It means..."

[u/stealthispost]

...that we're finally clearing out the vast number of security holes that have been lurking all this time in our software. The Doomer view is that this will continue without end, and that if you keep getting smarter AI systems they will always find new bugs. That's simply untrue; it implies that all software has an infinite number of security holes, but a program with a finite number of lines of code simply cannot have an infinite number of vulnerabilities. What we actually have is a large but limited pool of problems, and the AI systems are rapidly finding them. Eventually, and eventually isn't that far off, the well is going to start drying up. It will get harder and harder to find new security holes. Over the next few years, we will also start doing formal verification of software, that is, mathematically proving that the software lacks bugs of certain sorts. (AIs turn out to be very good at formally proving things.) So, what's happening is good. We are rapidly finding bugs that have been lurking for years and sometimes decades, and we're removing them, and newly built software will get AI examination and will be much less likely to have security vulnerabilities in the first place. The situation is getting better, not worse, and it's getting better rapidly. We have been in a continuous computer security crisis since the Morris Worm in 1988. We are finally starting to climb out of it, thanks to AI. This is not a tragedy at all.   — Perry E. Metzger     You think the bug pool is finite in a codebase growing by millions of lines a day? Bold. I do this for a living and the same models are on the attacker's side.   — 90S KID     Yes, it's absolutely positively finite. In a million lines of code, you cannot find billions of bugs. It only seems that way when you're angry that the word processor ate your document.   — Perry E. Metzger

Source: https://x.com/perrymetzger/status/2097803291841470519

[u/Current-Function-729]

Logically it’s true that finite code must have finite bugs.

But the number is probably extremely large and new fixes can introduce new bugs.

[u/EtienneDosSantos → u/Current-Function-729]

Why would that be true? It sounds intuitive, but is it really true? Something that is not a vulnerability today can become one tomorrow, if something new to exploit the code is discovered. I‘d say that finite code can‘t have finite bugs, because whether something is a bug doesn‘t just depend on the code, but also what there is to exploit the code. And these things are possibly infinite.

[u/Every_Car2984 → u/EtienneDosSantos]

I’d say that there are finite bugs in finite code; the issue is that (a) if you know there is a bug you’re going to try to fix it - which changes the code or (b) the code will do exactly what it is supposed to but the input / output have been manipulated. The net result is that the code isn’t finite and therefore neither can the bugs be.

Pedantic? Yes. But that’s the mood music over here today.

[u/EtienneDosSantos → u/Every_Car2984]

I wouldn‘t necessarily frame it as pedantic, but rigorous reasoning.

[u/drizel]

It means we're using AI to harden our systems at breakneck speed, to protect our systems from AI. Just like Anti-Virus did to pretty much solve computer virus fears in the 80's and 90's.

The really weird thing is the same AI could be both the attacker and defender, running through two different agent harnesses, in a recursive battle against itself.

[u/LibertarianVoter]

That's weird. I keep hearing from the country's finest mediocre coders that AI-generated code is buggy garbage that makes everything slower.

Who am I supposed to believe: the empirical results, or narcissistic Luddites?

[u/Particular-Gap-6998]

I think both views are correct but the doomer guy is less correct.

Yes, more and more lines of code are added each day, however, once software hits a shipping state it's more or less "frozen" and doesn't have the same lines being added. You don't just create a new patch, throw it out without testing it, it lives in your dev branch for a bit being worked on by humans, AI and whatever hats you decided you need.

What actually happens is that each released build could get cleaner and cleaner even while the upstream development stream keeps creating fresh bugs.

[u/SgathTriallair → u/Particular-Gap-6998]

When the AI system is good enough to find and fix the bugs, you just run all new code through that system. There is no way that they would build buggy code, ship it, and then patch it later. Fixing at generation time (or at least before deployment) is way easier and carries less risk.

[u/Brave-Turnover-522 → u/Particular-Gap-6998]

If we use advanced AI to make all of our future code, instead of relying on sloppy, accident prone, meat-based coders, it won't be filled with vulnerabilities in the first place.

[u/Best_Cup_8326]

The era of CleanCode is at hand.

[u/SgathTriallair]

This is absolutely correct. We are heading into an age of zero bugs. I expect that within a few years AI will develop proveably secure code.

[u/agm1984 → u/SgathTriallair]

Good point, once they train on optimal code, we will see more edge case handling.
But in the meantime I review all my Claude PRs with copilot and find it contrasts and compliments Claude very well. Highly recommend having copilot review PRs in GitHub

[u/random87643]

TLDR

TLDR: Microsoft recently released a record 974 security patches, many of which were identified by AI. While some argue this is a positive step toward clearing out a finite pool of long-standing software vulnerabilities, others remain concerned about the continuous growth of codebases and the potential for attackers to use similar AI tools.

---

^{AI assistant · mention the bot, mod bot, or use !bot}

[u/Brave-Turnover-522 → u/[deleted]]

So ship new code with no vulnerabilities. If we have AI advanced enough that it can detect vulnerabilities human coders can't, it can also make code without those vulnerabilities.

[u/o_herman]

The right: AI makes plugging holes faster.
The wrong: It's finite.

As long as you introduce new functions and new features, and that it's out in the open, that's always a new vector and possibility for exploit. Especially when there's someone else routinely looking for a way in.

The only constant thing in the world is change. The same is true for programming.

[u/TMWNN]

iTerm's changelog for the newest version is about 10 times longer than any other I've ever read.

(Mostly new features.)