The long-held, if often criticized, principle of "security through obscurity" has been rendered obsolete by the advent of artificial intelligence, according to cybersecurity experts and recent incident reports. This strategy, which relied on keeping system architectures and vulnerabilities secret to deter attackers, is now demonstrably ineffective as AI agents are proving adept at uncovering hidden weaknesses in both widely used and niche technologies.
Software vendors and independent researchers are increasingly deploying AI to identify bugs, including those in decades-old code and open-source projects, leading to a surge in security disclosures and patches. This phenomenon has created a significant backlog for project maintainers. For instance, open-source libraries that have been extensively stress-tested by the tech community for over a decade and were widely considered secure are now being found to contain significant vulnerabilities by advanced AI models.
The impact of AI on vulnerability discovery is evident in recent patch cycles. Microsoft's record-breaking Patch Tuesday, which addressed 974 CVEs, included fixes for components that have largely been forgotten, such as the Telnet client, Windows RNDIS (a USB-networking protocol Microsoft has sought to deprecate), NFS Portmapper (1980s Unix technology), and Link Layer Topology Discovery (a network-map protocol from the Windows Vista era). This indicates that AI is capable of scrutinizing and identifying flaws in even the most obscure and legacy parts of systems.
Compounding the defensive challenge, attackers are also leveraging AI to their advantage. They are using AI to reverse-engineer security fixes and develop exploits within hours of a patch's release. A recent example involved at least four espionage groups, many with suspected ties to China, who rapidly developed an exploit kit for open-source Chromium. This allowed them to compromise systems in the "patch-gap" window between the release of an upstream patch by maintainers and the subsequent stable release to users.
A significant concern highlighted by cybersecurity analysts is the implication for operational technologies (OT) and industrial control systems (ICS), which manage critical infrastructure like power grids, water treatment, and manufacturing. These systems have historically relied on obscure protocols and proprietary hardware and software, making them difficult for outsiders to understand or attack. AI has fundamentally altered this landscape, enabling individuals without specialized OT expertise to learn about these systems and develop destructive cyberattacks.
This is not merely a theoretical risk. Several US agencies recently confirmed that attackers utilized AI-generated exploitation scripts to breach internet-exposed Siemens S7 Series programmable logic controllers (PLCs) in critical facilities, including those in the water, manufacturing, and energy sectors. Experts warn that AI's proficiency in technical troubleshooting and understanding obscure systems makes it a potent tool for attackers studying not only the application layer but also operating systems and even firmware in ICS environments.
While the increased visibility into vulnerabilities may ultimately lead to more secure systems, the immediate challenge lies in the defensive capabilities. AI is currently more effective at identifying vulnerabilities than at automatically patching or remediating them. Recent studies underscore this disparity. One analysis of six CVEs found that AI-generated patches from OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8 had an average success rate of only 26.0 percent in fully resolving vulnerabilities without altering application behavior. Furthermore, 20 percent of successful patches still introduced unintended changes, such as modifying "allow list" logic to "deny list" logic. Conversely, AI-generated patches failed to resolve vulnerabilities, introduced new ones, or both, in an average of 53.9 percent of cases. Another study, evaluating over 100 models and 80 coding tasks, found an average security pass rate of just 56 percent for AI-generated code.
This imbalance means that organizations face an escalating volume of discovered bugs without commensurately advanced AI tools for rapid and reliable remediation. Experts caution that simply dedicating more resources to finding and fixing bugs without addressing underlying process failures that lead to their creation will prove unsustainable. The focus must shift to improving the entire security lifecycle, not just the detection phase, to avoid being overwhelmed by the sheer volume of newly exposed vulnerabilities.
