The AI bugpocalypse is here. Now what? - Jack Cable, Corridor

2026-07-12 · Source: AI Engineer · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Software Development & Engineering · Depth: Intermediate, long

Summary

Jack Cable, co-founder and CEO of Corridor, highlights the "AI bugpocalypse," where frontier AI models are increasingly proficient at discovering and exploiting software vulnerabilities, particularly in open-source libraries. With AI coding tools scaling rapidly (84% of developers used them last year), both attack surfaces and AI's ability to find and introduce vulnerabilities are expanding. Models like Anthropic's Mythos demonstrate rapid advancements in autonomous attack chains, while models like Opus 46 have introduced vulnerabilities leading to significant losses. Cable argues that most vulnerabilities found are not novel in class, advocating for a "secure by design" approach. He emphasizes memory-safe languages such as Rust and Go, which can prevent 60-70% of vulnerabilities in products written in memory-unsafe languages, citing Google's Android OS where memory safety vulnerabilities dropped from 75% in 2019 to 30% in 2022 by writing new code in these languages.

Key takeaway

For Directors of AI/ML overseeing software development, recognize that AI-driven coding accelerates both development and vulnerability introduction. Prioritize adopting memory-safe languages like Rust for new code and critical open-source components to fundamentally reduce common vulnerability classes. Implement robust AI coding tool guardrails to ensure security keeps pace with development velocity, enabling autonomous agents while maintaining system resilience against evolving AI-powered threats.

Key insights

Advanced AI models are accelerating both vulnerability discovery and introduction, necessitating a fundamental "secure by design" shift in software development.

Principles

• Vulnerability classes found by AI are often known and preventable.
• Memory-safe languages fundamentally reduce common vulnerability types.
• Defender access to powerful AI models outweighs risks.

In practice

• Shift new code development to memory-safe languages like Rust or Go.
• Implement guardrails for AI coding tools to prevent vulnerability introduction.

Topics

• AI Security
• Software Vulnerabilities
• Memory Safety
• Secure by Design
• AI Coding Tools
• Open-Source Security

Best for: CTO, VP of Engineering/Data, AI Architect, AI Security Engineer, Software Engineer, Director of AI/ML

Related on AIssential

• With $1 Cyberattacks on the Rise, Durable Defenses Pay Off — Generative AI accelerates both cyberattacks and defenses, necessitating a shift to foundational security rather than reactive patching.
• Did OpenAI’s New Model “Go Rogue”? — Autonomous AI systems, when paired with coding harnesses, can execute complex attack plans, necessitating stringent safeguards due to LLM unpredictability.
• The Trust Gap Behind the AI Coding Boom: What 200 Security Practitioners Just Told Us — AI-accelerated development outpaces security's manual validation, amplifying complex vulnerabilities.
• AI is getting scary good at finding hidden software bugs - even in decades-old code — AI excels at finding obscure bugs in legacy code but also expands the attack surface for unpatchable systems.
• MLWhiz Weekly Recsys/ML/GenAI Newsletter # 6 — AI capabilities are rapidly outrunning existing institutional frameworks in cybersecurity, coding, and language design.
• SecureCode: A Production-Grade Multi-Turn Dataset for Training Security-Aware Code Generation Models — AI code generation requires incident-grounded, conversationally structured datasets with operational guidance to produce secure code.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by AI Engineer.