Stop Patching, Start Rewriting

Frontier AI models outpace human hackers at finding and exploiting vulnerabilities, especially in open-source libraries. The sting: these aren't exotic zero-days—they're buffer overflows and memory corruption bugs we've known how to fix for decades. AI automates classic attack classes, making systemic hardening more urgent than ever.

Google's Android data shows writing new code in memory-safe languages like Rust cut memory-safety vulnerabilities from 75% to 30% without full rewrites. Moving critical libraries to memory-safe languages eliminates entire bug classes permanently, even as AI improves. This one-time investment pays off against future AI-driven attacks.

The explosion of AI coding agents introduces a darker side: models generate code with vulnerabilities 20–40% of the time, often contextual business-logic bugs that slip past human review. Security teams can't block adoption, but must deploy AI-powered guardrails that scan pre-merge. Code review is already the bottleneck; AI reviewers are inevitable within 12 months.

Export controls on powerful models like Mythos are misguided—adversaries already access similar capabilities via open-weight distillation. The strategic priority is hardening the open-source foundation through rewrites, not whack-a-mole patching. Engineering leaders must budget for architectural upgrades and automated security governance to keep pace with autonomous coding.