LAS VEGAS — The pace of AI-driven vulnerability discovery and exploit generation is accelerating.
The Microsoft Security Response Center is processing nine times the vulnerability volume it handled in March. A separate internal AI system turned 182 of 200 Linux kernel vulnerabilities into crash-level proofs of concept, many of them working root exploits, at an average AI processing cost of $3.61 and an average generation time of 21 minutes each.
For defenders already struggling to keep pace, the numbers suggest something close to an adversarial tsunami. Patching faster and detecting faster may help, but they increasingly resemble bailing out a sinking boat with a thimble.
“Hand-to-hand combat with attackers will cause us to lose in defense,” David Weston, Microsoft’s agentic security leader, told Black Hat USA attendees Wednesday.
Weston’s keynote, “The End of Rare: Defending When Offense Is Cheap,” challenged the status quo of enterprise security. The days may be numbered for a model in which defenders patch what they can, detect what slips through and trust that an adversary will take long enough to turn a bug into a working exploit for a fix to arrive first.
Scarcity is Dead
It used to be that, of the tens of thousands of CVEs logged, only roughly 90 were actually exploited in the wild, Weston said, citing Google researchers.
“What do we do when the scarcity principle no longer has our back?” Weston asked.
Weston, who spent two decades building operating-system security at Microsoft and now works in AI vulnerability-discovery and frontier-model research, said AI is changing the detect-and-respond dynamic.
He said the number of vulnerabilities the Microsoft Security Response Center processes and patches is doubling roughly every six weeks.
The wait-and-patch and detect-and-respond models are “wholly reliant” on an assumption that is being undermined. AI-assisted exploit generation has narrowed the window that used to buy defenders time. Attacker tools and techniques may no longer stay consistent enough to provide reliable detection signals.
Modernizing the Defender Mindset
The AI advantage is real, but attackers, with fewer compliance controls, approval gates and operational restrictions, are better positioned to use it first, Weston argued. AI, to some degree, has only perpetuated an old dynamic that needs to change.
“We don’t want to go vulnerability for patch,” he said. “We don’t want to go exploit for detection, evasion for detection.”
The required shift is not simply to deploy more AI against more AI. It is to use AI to change the underlying economics of defense.
Weston’s alternative is to invest in defenses that remain durable when attack volume increases: memory-safe development, secure-by-design architecture, formal verification and automated remediation.
In 2019, memory-safety flaws accounted for 76% of Android vulnerabilities. By 2025, that figure had fallen below 20%. Weston credited much of the decline to increased use of Rust, a programming language designed to block common coding mistakes involving how software stores and accesses data in a device’s memory. Rust’s built-in checks catch many of those errors while developers are still writing and compiling the code, before the software reaches users.
Microsoft applied the same approach to one of Azure’s most important security barriers: the software that isolates virtual machines from one another. The company rewrote a hypervisor component in Rust and has scaled it across more than 1.5 million virtual machines without an incident, Weston said.
Wider use of Rust to rewrite C and C++ code can require specialized developers and extensive work, he said. But AI could begin to remove some of that friction.
Microsoft Research used AI to build Rust Assistant, an automated coding tool that corrected 74% of the Rust compilation errors examined in one project without human intervention, Weston said.
The same principles can be applied to converting existing code to Rust. He pointed to TRACTOR, a DARPA project supporting the automatic translation of legacy C code into Rust.
Weston acknowledged these projects do not eliminate the industry’s enormous backlog of unsafe code. They suggest that remediation could eventually scale more like AI-assisted vulnerability discovery itself.
Formal Verification
Weston said AI is already finding complex cryptographic flaws, making formal verification — mathematically proving that code obeys specific security rules — increasingly important.
“Formal verification is almost tailor-made for AI,” Weston said. “It gives AI an oracle to write software that is provably safe against a set of properties that you need.”
Apple and Microsoft have applied formal verification to their core cryptographic libraries. Both efforts uncovered errors that had survived traditional testing.
Microsoft used agents to generate about 30,000 lines of proof code in one week to mathematically verify an encryption component in SymCrypt, the cryptographic library used across Microsoft products.
“If we could have that for all of the boundaries I talked about previously, we’d be in a different game with respect to AI,” Weston said.
Juicing formal verification with AI would not automatically solve every failure. It could allow developers to prove that critical components preserve specific security properties, rather than trusting that testing has covered every possible path.
Changing the Physics
None of these changes will happen quickly. The industry is carrying decades of software debt. Weston acknowledged that infrastructure is plagued by legacy systems, inconsistent configurations and security policies that machines cannot easily evaluate.
For sprawling infrastructure that won’t be rewritten or formally verified anytime soon, Weston argued the near-term fix is prevention over detection.
That means using AI to reason holistically over infrastructure-as-code, asset graphs and identity relationships. Agents can map assets and network flows, identify the most consequential risks and prioritize remediation that eliminates attack paths before attackers reach them, rather than trying to out-detect an adversary whose tooling can regenerate for each operation.
The purpose is not to dispatch one defensive agent after every offensive agent. It is to remove opportunities before an operation begins.
“We want to figure out where we can use this productivity advantage to actually turn the tables,” Weston said.
That means treating AI less as another product sprinkled over an existing patch-and-detect model and more as a chance to change that model.
Attackers will use AI to produce more vulnerabilities, more exploits and more disposable tooling. Defenders will not win by matching each item in the flood.
They have to build systems that give the flood fewer places to go.
Photo Credit: Security Point Break
