AI is getting very good at finding software vulnerabilities. Guy Arazi thinks that may be creating cybersecurity’s next problem.
Models can tear through enormous amounts of code and surface flaws faster than security teams can investigate them. Developers can fix them or companies can decide which ones matter. Discovery, once a rare commodity in vulnerability research, is getting cheaper.
What remains scarce is the judgment that comes next.
“We’re in a new era where there are too many reports and too many vulnerabilities,” Arazi said. “You don’t know what is (AI) slop, what’s not a slop and what to focus on next?”
Arazi has been thinking about a version of that problem long before the current AI boom. At Microsoft, where he worked as a security researcher, one of his biggest focuses was variant analysis. That describes the process that begins after a vulnerability is found. At Microsoft, that included determining whether the same underlying mistake existed somewhere else across Microsoft’s software estate.
Much of that work was laborious, manual and slow-going. Sometimes, Arazi said, a proper variant analysis could take months. The other common denominator was that the variant analysis only began after something broke.
“It always starts when something really goes wrong,” Arazi said. “Everyone knows about it, but no one knows where else.”
[Related: One CVE, 2,500 Instances: Pi Researchers Find Flaw in AWS SDK]
That “where else?” question is at the center of Pi’s thesis. It’s central to the security startup Arazi co-founded with Yoni Ramon, who previously led offensive security and in-house hacking at Tesla.
The company, founded in 2025, emerged from stealth on June 10. CTech reported Pi had raised $35 million in total: a $25 million Series A led by Third Point Ventures after a $10 million seed led by Brightmind Partners in early 2025. Forbes reported Pi was valued at about $100 million and counted xAI among its early customers.
Teaching the Machine What Matters
The more interesting Pi story, beyond the money and résumés, is where Arazi sees an opportunity to challenge the security world’s status quo.
Pi calls that institutional product-security memory or the context it trains its fleet of AI agents to use across triage, variant hunting, remediation, threat modeling and software development
Pi is not pitching another machine that simply finds more bugs. It is trying to capture the accumulated decisions that experienced security teams usually lose between incidents: why a vulnerability matters here, what caused it, how this company fixed it before, where else the same mistake might be hiding and what should stop it from returning.
“Imagine that you’re explaining a vulnerability to a colleague,” he said. Next, they might spend days searching through code, cloud infrastructure and a company knowledge base to figure out if another team made the same mistake.
Pi wants the colleague to remember the answer next time. It wants its AI “security brain” to remember every minute detail from design docs, code, cloud infrastructure, past incidents, fixes and previously accepted risks.
“We’re trying to understand the intentions, behaviors, and memories to better understand how we can provide those agents the right information and the knowledge,” Arazi said.
One Bug, 2,500 Echoes
Pi recently got the opportunity to demonstrate the concept.
On Monday, researchers traced an AWS SDK weakness to the way some SDKs accepted a user-controlled region value without properly validating it before using the value to construct an AWS endpoint.
[Related: One CVE, 2,500 Instances: Pi Researchers Find Flaw in AWS SDK]
Pi found that, under the right conditions, this could redirect a signed request to a server controlled by an attacker.
Arazi used a single instance of the SDK code flaw and found roughly 2,500 manifestations of the same behavior across generated AWS SDK clients and multiple programming languages.
He calls the abstraction an anti-pattern, or the vulnerable behavior stripped of its programming language and specific implementation.
Instead of searching for identical code, Pi searched for the mistake underneath it. It did not find 2,500 independently created bugs. The same missing safeguard had been propagated at scale through code generation. Pi surfaced the variants, and researchers manually validated them before disclosure to AWS.
“We’re extracting the anti-pattern,” Arazi said, “and then kind of understanding what other permutations are similar to it.”
For Arazi, the research illustrates something larger than one AWS flaw. Traditional security tools tend to find a vulnerable piece of code and open a ticket. What Pi is after is context.
As AI bug hunting balloons the number of CVEs security teams need to triage, context becomes a more important calculus in determining remediation and patching priorities.
In 2025, there were 48,244 CVEs published, up from 40,077 in 2024, according to the official tally. In the first quarter of 2026 alone, another 15,176 were published, about 26% more than during the same period a year earlier.
The Race to Give Agents Judgment
Pi is hardly alone in arriving at this AI Eureka moment.
At Black Hat, vendors repeatedly pitched variations of the same argument. The next generation of security automation will require more than a powerful model and a good prompt. It needs context, memory, verification and constraints, was the common refrain.
AWS researchers were among the minions. It demonstrated its own ThreatForest, an open-source multi-agent system that reads source code, builds attack trees, maps them to MITRE ATT&CK framework and then recommends mitigations. The system includes three human-in-the-loop validation points where security experts can correct its work before those judgments propagate.
The research also showed that more elaborate agent systems do not automatically produce better answers. ThreatForest did well on several tasks but stumbled badly on mapping threats to the MITRE ATT&CK framework, a task where a much simpler, single-call approach performed better. In plain English: you can build an elaborate agent system and still get a worse answer if one part of the reasoning pipeline is weak.
Tencent is chasing a similar idea. At Black Hat, researchers from Tencent’s Xuanwu Lab demonstrated an AI system that learns from historical patches and searches large codebases for variants of the same underlying flaw: “The bug is fixed. The model repeats.”
Different routes, same end zone: AI that does more than find another bug.
Memory Isn’t Enough
Pi’s wager is that its advantage will come from memory, turning what a company has learned about how it builds and breaks software into knowledge its agents can reuse.
Arazi said Pi is trying to “understand how an organization builds and breaks all software” and apply that knowledge across design reviews, threat modeling and production remediation.
“Agents will soon do everything,” he said. They will scan code, create remediations and run threat modeling, Arazi said. What they lack, in his view is enough “accurate data that will always keep them fresh.” Pi is trying to recreate that knowledge through what Arazi calls intentions, behaviors and memories.
Microsoft’s David Weston offered a caution at his Black Hat keynote that faster defensive AI does not automatically solve the problem created by faster offensive AI.
Attackers moved first, he said, in part because defenders operate under constraints attackers do not, such as policy, auditing, compliance and cost. Trying to answer every attacker action with another machine-speed action risks trapping defenders in an arms race they cannot win.
“Hand-to-hand combat with attackers will cause us to lose in defense,” Weston said.
There is another problem: the agents themselves can be inconsistent.
At Black Hat, Pixee CTO Arshan Dabirsiaghi described what he calls “jitter,” the tendency of an AI security system to reach different conclusions when given the same evidence. Give a security agent the same facts twice and it may reach different conclusions. One run says false positive. Another says real vulnerability.
Better models asked better questions, but they did not eliminate the inconsistency. Dabirsiaghi’s conclusion was that useful security agents need guardrails, memory and reliable organizational context.
That lands close to Arazi’s thesis and shows where the hard part remains. In Pi’s AWS research, the agents found the variants, but researchers verified them before disclosure.
The machine generalized. Humans made the call. Pi is betting that gap can shrink.
