Each day seems to bring fresh havoc in the digital world. In recent weeks, researchers have uncovered security flaws in some of the most consequential corners of the internet, bugs that could put users at risk, jeopardize essential services and impose significant economic costs. Squint a little, though, and it looks like progress.

In August, researchers found flaws in the PHP programming language — which underpins roughly 70% of the world’s websites — that could’ve allowed hackers to steal data or install malware on a huge scale, prompting a warning from the National Security Agency and a global effort to patch the bug. Other flaws have recently been found in systems ranging from Linux to OpenSSL to FreeBSD.

Nor are these isolated incidents. Project Glasswing — a cybersecurity initiative started by Anthropic PBC, which granted select companies and security researchers access to a specialized version of the Claude AI model — found more than 129,000 verified software vulnerabilities between April and July alone, many of critical severity. Anthropic independently found thousands more.

Such reports may sound like portents of a future AI apocalypse. In fact, they’re cause for guarded optimism.

Note, first, that many of these flaws have been lurking undetected for years; discovering and patching them makes the broader system safer. AI-assisted defenders are proving especially adept at finding weaknesses in widely used software that traditional testing has missed: Problems in PHP had been evident as early as 2024, for instance, but it took AI to grasp their full significance.

It’s also clear that AI is transforming the economics of security research. Defenders can now use agents to scan for weaknesses at unprecedented scale and speed, and to scour places — like old libraries and codebases — that once would’ve been too costly or impractical to investigate. An AI tool that Microsoft Corp. tested on the Linux kernel earlier this year took, on average, about 22 minutes and just $3.60 to verify each suspected flaw.

So far, defenders appear to have at least a temporary advantage. Although criminals are using AI to find vulnerabilities and coordinate attacks, there’s little evidence that they’ve achieved widespread success. A report by Google’s threat-intelligence team found that while monthly vulnerability disclosures roughly doubled over the first half of the year, only about 0.2% of all those found had actually been exploited by hackers.

This implies a crucial window for hardening defenses. For cybersecurity pros, the immediate challenge will be to advance from finding flaws to fixing them. Top AI models are quickly getting better at writing patches, yet deploying them widely — and at the requisite speed — remains a problem. One study found that companies fully fixed only 26% of known-to-be-exploited vulnerabilities last year; at many organizations, 30 to 60 days remains the norm for critical flaws.

For policymakers, the goal should be to accelerate that process where possible. The White House should expand its efforts to get frontier AI cyber capabilities to as many vetted defenders as possible while modernizing the existing vulnerability management process. Federal procurement rules should insist on secure automated updating and other software best practices, along the lines of the Cybersecurity and Infrastructure Security Agency’s “Secure by Design” pledge. Congress must invest in defending critical infrastructure, including essential open-source projects.

In truth, it isn’t hard to imagine a day when the entire defensive process unfolds behind the scenes, seamlessly and automatically, with internet users blissfully unaware. Getting from here to there, though, could be an eventful journey.

____

The Editorial Board publishes the views of the editors across a range of national and global affairs.

©2026 Bloomberg L.P. Visit bloomberg.com/opinion. Distributed by Tribune Content Agency, LLC.