The AI bugpocalypse is here. Now what? - Jack Cable, Corridor

Jack Cable, co-founder and CEO of Corridor, addresses the emerging “AI bug apocalypse,” where frontier AI models are rapidly advancing their capabilities to discover and exploit software vulnerabilities. This phenomenon is exacerbated by the exponential growth of AI coding tools, which simultaneously increase the attack surface. He emphasizes that while AI models can find vulnerabilities, they also introduce them, with some benchmarks showing models introducing vulnerabilities in 20-40% of generated code, often due to a lack of contextual understanding of business logic or proprietary threat models.

Cable advocates for a “secure by design” philosophy, stressing that the vulnerabilities found by AI are often not novel in class but are rather long-standing, preventable issues. He highlights that approximately 60-70% of vulnerabilities in products written in memory-unsafe languages (like C or C++) could be completely prevented by using memory-safe languages such as Rust or Go. He cites Google’s Android operating system, which has seen a significant reduction in memory safety vulnerabilities by writing new code in safer languages, demonstrating that fundamental shifts, like strategic rewrites of critical libraries, can provide long-term security dividends rather than just “playing whack-a-mole” with one-off patches.

He notes the rapid evolution of AI in software development, moving from simple autocompletion to autonomous agents that can generate large code changes and will soon perform the majority of code reviews. Cable argues that security teams must enable this acceleration with “guardrails,” focusing on preventing vulnerabilities before the pull request stage and providing visibility into AI coding tool usage. He stresses that security cannot be a blocker to development velocity.

From a policy perspective, Cable shared recommendations with the US Congress, including:

• Preventing vulnerabilities in new code: Ensuring security keeps pace with accelerated AI-driven development.
• Hardening the open-source foundation: Systemic changes, including strategic rewrites, are needed to address vulnerabilities in open-source software, which acts as a proving ground for adversaries using AI.
• Fostering an ecosystem of American-made open-weight models: This is crucial for competitiveness, allowing companies to fine-tune models and drive innovation beyond closed-weight offerings.

Cable concludes that given the dual-use nature of powerful AI models and the rapid advancements in open-weight AI, defenders must focus on fundamental controls and leverage AI to build inherently more resilient software systems, protecting against both current and future threats.

• Tags:
• Autonomous Agents
• AI Security
• Feature
• Go
• AI Coding
• Memory Safety
• Vulnerability Discovery
• Secure by Design
• Rust
• Open-Source Security
• Cybersecurity Policy