AI just killed security through obscurity, and the patch backlog is exploding

Security through obscurity is dead, and AI delivered the fatal blow. That is no longer a metaphor: at Black Hat and in the days after, FBI Cyber Division assistant director Brett Leatherman and Trend Micro's Zero Day Initiative chief bug hunter Dustin Childs told The Register that AI agents are now finding vulnerabilities that survived a decade of scrutiny, including libraries running in 80 percent of web servers. The proof landed in Microsoft's record-breaking Patch Tuesday, which addressed 974 CVEs, including components like Telnet client, Windows RNDIS, NFS Portmapper, and Link Layer Topology Discovery, the Vista-era protocol nobody has thought about since Vista.

The consequence is not just more work for sysadmins. It is a structural shift in the offense-defense balance. Attackers are using AI to reverse-engineer fixes and build exploits within hours. In one recent case, at least four espionage crews, most suspected of links to China, slammed shut the patch-gap window for open source Chromium, using an exploit kit developed after maintainers released an upstream patch but before the downstream stable release reached users. The window that used to protect organizations while they patched is now being exploited by machines that move faster than human teams.

The stakes extend beyond traditional IT. Former US National Cyber Director Chris Inglis and John Hultquist, chief analyst at Google Threat Intelligence Group, told The Register they worry about operational technology and industrial control systems: the obscure protocols and proprietary hardware that run water, power, and gas. Historically, obscurity protected these systems because the expertise lived in a handful of people's heads. AI has ingested all of it. Hultquist said criminals no longer need to be OT experts; they can ask an agent to learn the system and do the dirty work. A couple of weeks after Black Hat, five US agencies said attackers used AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series PLCs at water, manufacturing, energy, and other critical facilities. "This is not a theoretical risk - it is an active threat," the feds warned.

Katie Moussouris, founder and CEO of Luta Security and the fairy godmother of bug bounties, told The Register that security through obscurity was never a winning strategy. "The argument always fails in the face of someone who decides to turn their gaze towards your organization. If there is something to find, they will find it." AI makes that gaze cheaper and faster. People who lack familiarity with a particular tech stack are no longer barred from attacking it, because AI has ingested everything and can enumerate weak spots. But Moussouris is quick to point out that finding bugs was never the hard part. The hard part is triaging, prioritizing, and actually getting fixes deployed.

That is where the defense side is failing. Two recent studies show AI-generated patches fail more than half the time. 1Password's research team took six CVEs disclosed since March and produced 6,080 patches using OpenAI's ChatGPT-5.5 and Anthropic's Opus 4.8. The average success rate for a patch that fully resolved the vulnerability without materially changing application behavior was just 26.0 percent, according to Director of Security Research Keith Hoodlet. Even patches that fixed the flaw mucked up the application's behavior 20 percent of the time, changing allow list logic to deny list logic. LLM-generated patches did not resolve the vulnerability, added a new vulnerability, or both, an average 53.9 percent of the time. Veracode's study across more than 100 models and 80 coding tasks found an average security pass rate of just 56 percent.

Moussouris warns that organizations that respond by throwing more resources at finding and fixing bugs will "die on the treadmill." They will literally have a heart attack and die, she said, because there is no VO2 max fast enough to deal with all those bugs. The answer, she argues, is a more dynamic approach: assess where your organization can find patterns that lead to process improvement instead of patching vulnerability after vulnerability. Many organizations don't even know how to measure progress, so they count bugs and speed of fixing. That is one way to measure, but it doesn't show the entire picture. They need to look at types of vulnerabilities and the process failures that created them.

For CISOs and boards, the strategic implication is clear: the era of hiding is over, and the era of triage is here. The record 974-CVE Patch Tuesday is not an anomaly; it is the new baseline as AI agents continue to stress-test code that was once considered secure. The organizations that survive will be those that invest in process improvement, automated remediation that actually works, and a realistic understanding that AI has not caught up on the defensive side. As Moussouris put it, "AI is shining that bright light on the wrong end of the security picture, and unfortunately, AI hasn't caught up on the defensive side." The window for complacency has closed, and the treadmill is speeding up.