Everything hackable will get hacked

The material notes that AI models have become much more capable of performing cybersecurity work, which is reshaping both the threats facing the web and the tools available to defend it. This shift means that the same advances that improve attack automation also improve defensive automation. Engineers must consider how these dual-use capabilities affect their threat models and defense strategies.

Defenders currently hold an advantage because they can employ stronger models for defensive work than the open-weight models broadly available for offensive research. However, the material warns that this advantage will not last, as the gap between offensive and defensive model capabilities is expected to close soon. Teams should weigh the cost of integrating current frontier models into their security pipelines against the limited window of advantage.

Near-frontier open-weight models that can conduct offensive security research are already accessible; the example given is Kimi K3, which lacks relevant cybersecurity safeguards. At the same time, frontier models, except for Fable 5, are said to be able to perform defensive cybersecurity tasks today. This juxtaposition shows that defensive tools are ready for deployment while offensive tools are already in the wild.

The discussion points out that uncertainty surrounding the release of Mythos 5 has created a kind of paralysis among defenders, leading many to underutilize the powerful tools they already possess. This hesitation represents a cost: delayed adoption of available AI-driven defenses increases exposure to threats that could be mitigated now. Engineers should treat the current toolset as sufficient to act on, rather than waiting for future model releases.