AI Now Finding Real Security Flaws After Years of Failures

Artificial intelligence just went from being a nuisance to a powerful ally in protecting the software that runs our digital lives.

For years, Daniel Stenberg watched AI-generated junk flood his inbox. Stenberg leads the team behind cURL, a 30-year-old tool that helps everything from cars to medical devices connect to the internet. In 2025, hackers using AI sent him 185 bug reports, but fewer than 5% actually flagged real security problems.

The fake reports were so bad that Stenberg stopped paying rewards to people who found bugs. He could spot the AI-written ones immediately because they'd use 400 lines to describe something a human would explain in 50.

Then something shifted in early 2026. New AI models got dramatically better at understanding code. Almost overnight, the flood of useless reports dried up.

Now about 1 in 10 reports Stenberg receives flags an actual security vulnerability. The rest mostly identify real bugs that affect how software works. "Almost all the bad reports are now gone," he said.

The biggest leap came this week when AI company Anthropic announced Mythos Preview, a model so good at finding security holes that they're limiting who can use it. The model found serious vulnerabilities in every major operating system and web browser.

The company is sharing access with only 50 trusted organizations through Project Glasswing, named after a butterfly with transparent wings. They say the risk of misuse is too high for a public release.

The Bright Side

This breakthrough means the small teams protecting critical software finally have backup. Jim Zemlin leads the Linux Foundation, which oversees software powering Android phones and the world's 500 most powerful supercomputers. He said his already overworked team of maintainers is testing how the new AI can help them work faster.

Security experts say everyday people shouldn't worry about hackers using these tools. "They need to be way more worried about not giving their password away because that just happens like all day, every day," said Daniel Blackford from cybersecurity firm Proofpoint.

The irony is perfect: AI spent years making security researchers' lives harder by generating fake reports, and now it's making their jobs easier by finding real problems they might have missed.

The software protecting your morning coffee maker, your car, and your hospital's equipment just got a much-needed upgrade.