Part one
Developers
on letting AI write their code
Rung 1 of 5
Never
AI isn’t trusted with real code
38 people · Jan 2023 to May 2026
-
Jan 2023
“I don't trust people's code (especially mine,) and I surely don't trust ChatGPT's output.”
Santiago Valdarrama Machine learning engineer and educator dspn.substack.com
-
17 Mar 2023
“It seems like it can only do very rudimentary things, and it usually gets them partially wrong”
-
22 Mar 2023
“me and quite a few others I know tried it and turned it off.”
Mike Hearn Former Google engineer, early Bitcoin developer news.ycombinator.com
-
4 Apr 2023
“ChatGPT should NOT be trusted to give you production ready code”
-
4 Apr 2023
“It can't understand complex systems (even just for the simple reason that you can't throw all the code at it).”
-
7 Apr 2023
“I myself shall certainly continue to leave such research to others, and to devote my time to developing concepts that are authentic and trustworthy.”
Donald Knuth Author, The Art of Computer Programming www-cs-faculty.stanford.edu archived copy
-
31 May 2023
“AI can't code as well as I can on platforms I'm expert in.”
-
Jun 2023
“The code generated by Copilot is often wrong, but always subtly so”
Chris Krycho Software engineer, Ember.js and TypeScript v5.chriskrycho.com
SurveyStack Overflow 2023
42% trust its output 27% distrust-
4 Jun 2023
“Here's why I don't use Copilot (or ChatGPT) to write code”
Ed Summers Software developer, digital libraries inkdroid.org
-
26 Jul 2023
“So my hope that ChatGPT could help me in writing some boost::graph code to parse graphviz files was unfortunately not successful.”
-
4 Sep 2023
“I turned off Copilot recently and realized it made me a better programmer even without it.”
-
2 Jan 2024
“Whenever subtle reasoning is required, LLMs fail disastrously.”
-
17 Jan 2024
“Wasted an hour and deleted some config data because of a subtle bug in Copilot generated code.”
-
2 Apr 2024
“The time saved in generating code was subsequently lost to debugging and verifying the AI's output.”
-
16 Apr 2024
“I disabled Copilot in VSCode and RStudio yesterday and (subjectively) my creativity and productivity went *up*.”
Stephen Turner Associate Professor, UVA School of Data Science x.com
-
17 Apr 2024
“I wouldn't trust LLMs to do anything of real import.”
Molly White Software engineer, writer of Citation Needed citationneeded.news
-
19 Apr 2024
“Let's wait 10 years and see where it actually goes before we make all these crazy announcements.”
-
12 Jun 2024
“Oh, has it changed how I program? No, no, not, not at all.”
-
14 Jun 2024
“I've not made AI assistance a part of my regular code workflow.”
-
19 Jun 2024
“it's impressive, but not actually suitable for anything more than churning out boilerplate.”
Nikhil Suresh Data engineer, writer of Ludicity ludic.mataroa.blog
-
2 Jul 2024
“me: That code is busted.”
-
7 Jul 2024
“I tried co-pilot for a year”
-
23 Aug 2024
“Canceled Copilot”
-
24 Aug 2024
“However, in my own workflows I have not found them to lead to any productivity boost.”
-
30 Sep 2024
“Using CoPilot, I typed somewhat less, but did more code review, editing, & diagnosis of subtle bugs. No net time saved.”
-
6 Oct 2024
“As more and more AI slop, generated code gets pushed to repos, the ability to go into a random codebase and debug something becomes more and more valuable.”
-
16 Nov 2024
“I don't see how language models can help me solve problems faster.”
-
21 Dec 2024
“No, I don't see a reason to use LLMs in day-to-day programming at all, unless the code I am trying to produce is quick throwaway junk”
-
29 Dec 2024
“I use o1 for brainstorming design sometimes but would never trust its code”
-
Jan 2025
“any productivity gains from using the AI were net neutral at best.”
-
10 Mar 2025
“they still make basic mistakes.”
Mark Seemann Author, Code That Fits in Your Head blog.ploeh.dk
-
1 Apr 2025
“In late 2024 I removed all LLM integrations from my code editors.”
-
2 Apr 2025
“Every inline-coding AI assistant I've tried made me want to gnash my teeth together”
-
4 Jun 2025
“I have seen very few successful examples of using genAI to produce whole, working systems.”
-
12 Jul 2025
“I don't let it drive my code. I've tried that.”
-
13 Oct 2025
“I tried to use claude/codex agents a few times but they just didn't work well enough at all and net unhelpful”
-
18 May 2026
“They generate more bugs, more security holes.”
Bjarne Stroustrup Creator of C++ developing.devCounterpoint
Meanwhile, a few early calls
-
24 Jan 2023
“The hottest new programming language is English”
Andrej Karpathy OpenAI co-founder x.comEarly call
-
19 Apr 2023
“The value of 90% of my skills just dropped to $0. The leverage for the remaining 10% went up 1000x.”
Kent Beck Creator of Extreme Programming newsletter.kentbeck.comEarly call
Rung 2 of 5
Some code, never production
Every line gets read
15 people · Aug 2023 to Sep 2026
-
27 Aug 2023
“I will never commit code if I can't both understand and explain every line of the code that I'm committing.”
-
9 Dec 2023
“I want to understand, refine, and perfect every line, so manually having to copy code is a feature not a bug”
SurveyStack Overflow 2024
43% trust its output 31% distrust-
6 Jan 2025
“Your job as a programmer using an LLM is to read the code it produces, think about it, and decide if the work is good.”
-
4 Feb 2025
“It's rare that I let Copilot produce business logic for me”
-
5 May 2025
“the only code I can stand by is the code I am fully confident in its implementation.”
-
12 May 2025
“AI coding is used to generate a lot of bulk code that is often blindly accepted”
-
2 Jun 2025
“There's plenty of things I can't trust an LLM with. No LLM has any of access to prod here.”
-
6 Jun 2025
“But for important things, like my fucking auth system, I'd much rather do it myself”
-
14 Jun 2025
“I could only incorporate AI generated code into a project of mine after I thoroughly review it and make sure I understand it well.”
Miguel Grinberg Author, Flask Mega-Tutorial blog.miguelgrinberg.com
-
Developers10 Jul 2025Counterpoint
METR trial: experienced developers are 19% slower with AI, yet believe they were 20% faster. metr.org
-
8 Aug 2025
“I use it for scaffolding and let it handle the boring parts. But I write the core logic myself.”
-
Oct 2025
“Code still needs to be read and reviewed by humans, otherwise we risk losing control of our existence completely.”
-
30 Oct 2025
“I feel like I get a 10 to 20% improvement—some really fancy code completion and autocomplete.”
-
Dec 2025
“This is especially valuable for code that is experimental or auxiliary or otherwise throwaway.”
-
21 May 2026
“We should thus treat LLM-generated software with skepticism, it can still be useful, but we need to be aware of the risks.”
Martin Fowler Thoughtworks martinfowler.comCounterpoint
-
14 Sep 2026
“AI is not yet good enough for extremely high performance software (but it will be).”
Elon Musk CEO, Tesla and xAI x.comCounterpoint
Rung 3 of 5
Some of it ships
Low-risk work goes to production
23 people · Sep 2024 to Oct 2026
-
20 Sep 2024
“when I'm writing production code, code that I intend to ship, then it's much more like I'm treating it basically as an intern who's faster at typing than I am.”
-
29 Oct 2024
“More than a quarter of all new code at Google is generated by AI, then reviewed and accepted by engineers.”
-
Developers2 Feb 2025
Andrej Karpathy coins “vibe coding,” fine for “throwaway weekend projects.” simonwillison.net
-
Jun 2025
“I was trying to validate my skepticism. I ended up proving myself wrong.”
-
2 Jun 2025
“Almost nothing it spits out for me merges without edits. … I have to read the code line-by-line anyways.”
-
25 Jun 2025
“increased the scope to see if augmented coding could create production-ready, performance-competitive library code.”
Kent Beck Creator of Extreme Programming newsletter.kentbeck.com
SurveyStack Overflow 2025
33% trust its output 46% distrust-
9 Jul 2025
“For me personally, the minimum I want to still care about and be on top of is the test code.”
Birgitta Böckeler Distinguished Engineer, Thoughtworks martinfowler.com
-
2 Sep 2025
“Today, AI writes 80% of my initial implementations while I focus on architecture, review, and steering multiple development threads simultaneously.”
-
8 Oct 2025
“every one of our engineers, 100% is now assisted by AI coders, and our productivity has gone up incredibly.”
Jensen Huang CEO, Nvidia cnbc.comLab claim
-
11 Oct 2025
“a key skill in working effectively with coding agents is developing an intuition for when you don't need to closely review every line of code they produce.”
-
2 Nov 2025
“We've settled on 2 human approvals for any AI-initiated PR for now”
-
Dec 2025
“The closer code is to the system that we ship, the greater care needs to be shown when using LLMs.”
-
6 Dec 2025
“generally almost right even if the code is bad”
-
Then2 Apr 2025
“Every inline-coding AI assistant I've tried made me want to gnash my teeth together”
8months
Now22 Dec 2025
“I still kind of hate AI agents and feel ambivalent toward them. But they work.”
-
5 Feb 2026
“my personal journey from AI skeptic to someone who finds a lot of value in it daily”
-
16 Feb 2026
“I wouldn't run my production apps—that actually make money or could cause harm if they break—on unreviewed AI code.”
Jeff Geerling Maintainer of 300+ open-source projects jeffgeerling.com
-
ThenJan 2025
“any productivity gains from using the AI were net neutral at best.”
13months
Now27 Feb 2026
“it's enough to be less cynical and more optimistic about agentic coding.”
-
28 Feb 2026
“Shock! Shock! I learned yesterday that an open problem I'd been working on for several weeks had just been solved by Claude Opus 4.6”
Donald Knuth Author, The Art of Computer Programming www-cs-faculty.stanford.edu archived copy
-
12 Mar 2026
“claude code is dangerous for work life balance.”
Stephen Turner Associate Professor, UVA School of Data Science x.com
-
5 Apr 2026
“reviewing every change thoroughly, fixing problems eagerly as I spotted them”
-
11 Jul 2026
“Claude code is the best harness. It's not even close.”
-
8 Sep 2026
“Here's how I am making custom hardware for my house using codex”
-
25 Sep 2026
“6 months ago I was super against everything coding with LLMs”
-
7 Oct 2026
“Can you see my journey of doing more and more coding using AI agents”
-
20 Oct 2026
“UI and glue. if it is wrong, you see it and regenerate it”
Rung 4 of 5
They stop writing code
Agents write nearly all of it
20 people · Sep 2025 to Oct 2026
-
Then4 Apr 2023
“It can't understand complex systems (even just for the simple reason that you can't throw all the code at it).”
29months
Now29 Sep 2025
“I'm probably north of 90% AI-written code”
-
Developers24 Nov 2025
Claude Opus 4.5 ships. Developers later call it the turn. anthropic.com
-
27 Dec 2025
“In the last thirty days, 100% of my contributions to Claude Code were written by Claude Code”
-
2 Jan 2026
“I gave Claude Code a description of the problem, it generated what we built last year in an hour.”
-
5 Jan 2026
“I no longer write any code by hand from scratch, at all.”
-
Then19 Apr 2024
“Let's wait 10 years and see where it actually goes before we make all these crazy announcements.”
21months
Now9 Jan 2026
“The python visualizer tool has been basically written by vibe-coding.”
-
Then2 Jan 2024
“Whenever subtle reasoning is required, LLMs fail disastrously.”
24months
Now11 Jan 2026
“Writing code is no longer needed for the most part.”
-
19 Jan 2026
“the era of humans writing code is over”
-
20 Jan 2026
“I have engineers within Anthropic who say I don't write any code anymore. I just let the model write the code, I edit it.”
-
Then13 Oct 2025
“I tried to use claude/codex agents a few times but they just didn't work well enough at all and net unhelpful”
3months
Now26 Jan 2026
“I rapidly went from about 80% manual+autocomplete coding and 20% agents in November to 80% agent coding and 20% edits+touchups in December.”
-
21 Feb 2026
“As of mid-February 2026, I effectively no longer handwrite code.”
-
21 Mar 2026
“I didn't write a single line of... anything. Agents wrote 100% of everything you see”
-
24 Mar 2026
“Lessons from six months of letting AI agents write my code for me”
Luke Wilson Engineer, Project Autonomy projectautonomy.substack.com
-
31 Mar 2026
“I get AI help with everything now except for writing and wiping my ass, and both are on the short list.”
-
14 May 2026
“this is already the status quo; we haven't been typing code ourselves for many months now.”
-
13 Jul 2026
“Is it just me or is "open up a Claude Code (or Codex) session" becoming the default for doing work?”
-
Then12 Jul 2025
“I don't let it drive my code. I've tried that.”
13months
Now26 Aug 2026
“It was full throttle, 100%, everything is written by agents but steered by me.”
-
27 Aug 2026
“In February of this year, I made a rule for myself: I wasn't going to write code by hand anymore.”
SurveyStack Overflow 2026
Question changed. Now 48% trust AI output “when I can easily verify” it.
-
6 Oct 2026
“Nearly all of the most productive software engineers I've met – who were hand-writing code a year ago – no longer write the code by hand”
Gergely Orosz The Pragmatic Engineer newsletter.pragmaticengineer.com
-
20 Oct 2026
“I recently built an admin interface for a customer project without writing a single line of code myself.”
-
20 Oct 2026
“almost none of that code was typed by a human? That's where my team is today.”
Rung 5 of 5
They stop reviewing it
The code ships as written
16 people · Feb 2025 to Oct 2026
-
2 Feb 2025
“I "Accept All" always, I don't read the diffs anymore.”
-
28 Dec 2025
“These days I don't read much code anymore.”
Peter Steinberger Founder of PSPDFKit, creator of OpenClaw steipete.me
-
Jan 2026
“I don't read the code. But I read the agent output religiously.”
-
14 Jan 2026
“Gas Town, which runs all its Claude Code workers with --dangerously-skip-permissions.”
-
Feb 2026
“increasingly I am not reading every line of every PR.”
-
Then27 Aug 2023
“I will never commit code if I can't both understand and explain every line of the code that I'm committing.”
33months
Now6 May 2026
“as the coding agents get more reliable, I'm not reviewing every line of code that they write anymore, even for my production level stuff.”
-
14 Jul 2026
“if you control the ideas of your software, looking at the code itself is suboptimal and often pointless.”
-
Then12 Jun 2024
“Oh, has it changed how I program? No, no, not, not at all.”
25months
Now23 Jul 2026
“My current strategy is to not read any of the code written by my agents.”
-
ThenJan 2023
“I don't trust people's code (especially mine,) and I surely don't trust ChatGPT's output.”
43months
Now8 Aug 2026
“I'm officially done reading AI-generated code”
Santiago Valdarrama Machine learning engineer and educator explainx.ai
-
27 Aug 2026
“I didn't read a single line of its code, nor did I really pay attention to how it was architected.”
-
21 Sep 2026
“Agreed that reviews in the form of reading every line of code are dead.”
-
28 Sep 2026
“But again, I don't intend to spend any time writing it or reading it. It's a prompt compilation target. So who cares.”
-
4 Oct 2026
“I review the plan, not the code.”
-
17 Oct 2026
“I held firm for the longest time, but I'm calling it: as of Astra and Opus 5.5, you don't need to read the code anymore.”
-
17 Oct 2026
“In my personal project, I don't review most of the code anymore”
-
20 Oct 2026
“Most code is AI-written but we do a high-level review, run it and use the apps”
Part two
Offensive security
on AI finding and exploiting bugs
Rung 1 of 5
AI can’t hack
No real bugs, just noise
32 people · Jan 2023 to Oct 2026
-
31 Jan 2023
“I was legitimately a malware developer for a decade and it took me three hours to get a functional piece of code”
-
9 Feb 2023
“Don't use ChatGPT for security code review. It's not meant to be used that way, it doesn't really work”
-
22 Feb 2023
“We don't think AI is the future of hacking, but it could certainly turn into a great assistant”
Dustin Childs Head of threat awareness, Zero Day Initiative theregister.com
-
14 Mar 2023
“GPT-4 performed poorly at building exploits for the vulnerabilities that were identified.”
-
17 Mar 2023
“It couldn't do it. No matter how I crafted the prompts, it couldn't come up with the deep, technical response I was alluding to.”
Justin Gardner Bug bounty hunter, Critical Thinking podcast x.com
-
20 Mar 2023
“ChatGPT responds to every request with a high degree of confidence whether it's right or wrong, whether it's outputting functional or nonfunctional code.”
Nathan Hamiel Security researcher, Kudelski Security threatshub.org
-
22 Mar 2023
“It lacks the ability to reason about the proper concepts and produces too many false positives for practical usage in audit tasks.”
Trail of Bits auditors Dinaburg, Feist and Schirone blog.trailofbits.com
-
14 May 2023
“there's no chance for an LLM-based solution to replace penetration testers.”
-
Security12 Jul 2023
Bugcrowd survey: 72% of hackers say AI will never replicate their creativity. bugcrowd.com
-
18 Oct 2023
“A "researcher" uses an LLM to find a vulnerability in curl that is COMPLETELY hallucinated.”
-
1 Jan 2024
“We're not exactly there yet, but I believe that this will be a reality”
Mikko Hyppönen Chief research officer, WithSecure thenextweb.com
-
2 Jan 2024
“I strongly suspect we will get more LLM generated rubbish in our Hackerone inboxes going forward.”
-
2 Jan 2024
“we're soon to see a top reason security issues don't get fixed will be because they are lost in the sea of LLM generated nonsense bug bounty reports.”
-
2 Jan 2024
“LLM reports -> LLM triage = Self LLM-licking ice cream cone”
-
4 Mar 2024
“I don't find any of these models useful for non-BS tasks. They don't write very nice text and they can't solve any sort of real research problem.”
-
5 Mar 2024
“If you want to evaluate your AI technique then benchmark it against real auditors on fresh codebases.”
-
12 Mar 2024
“curiosity is the one thing that we can’t automate. AI is not going to replace that anytime soon”
-
13 May 2024
“never replace dedicated hackers, truly the most skilled people out there”
-
9 Jun 2024
“So far it has identified issues that are technically correct but aren't actually an issue within the larger context of the how the code is used.”
-
9 Jun 2024
“…it would save me N hours of work fixing bugs instead of costing me N hours of work triaging false positives. Nobody has presented such a demonstration yet”
-
21 Jun 2024
“tried to use LLMs to solve simple bug-finding CTF-style problems and had quite poor results (as you would expect)”
Dave Aitel Exploit developer, Immunity founder cybersecpolitics.blogspot.com
-
26 Jun 2024
“The day LLMs become capable of autonomously finding / exploiting 0-days is the day we can retire & put most of the security industry out of business.”
-
8 Sep 2024
“I don't think using out-of-the-box LLM (local or not) can do anything similar to real-world bug hunting.”
-
5 Nov 2024
“We're not there yet. We're not even remotely there yet. But it's a reasonable extrapolation.”
Bruce Schneier Security technologist, Harvard Kennedy School schneier.com
-
18 Nov 2024
“I've seen headlines saying that it's happened but when I look into it, it always turns out to be a narrow situation that's not very useful in the real world.”
Luke Stephens (hakluke) Bug bounty hunter, founder of Ironbark Cyber x.com
-
2 Dec 2024
“I'm looking forward to the day where AI finds bugs in software someone actually uses.”
Joshua J. Drake Security researcher, found Stagefright x.com
-
3 Dec 2024
“These low-quality reports should be treated as if they are malicious.”
Seth Larson Security developer, Python Software Foundation sethmlarson.dev
-
19 Dec 2024
“AI tools flooding GitHub & Medium with "vulnerability writeups" and CVE POCs that are completely broken, entirely hallucinated, or simply pure fantasy.”
-
6 May 2025
“Good god did they hallucinate the segmentation fault and the resulting GDB trace too? … this is truly a new low for AI slop bug reports.”
-
7 May 2025
“A threshold has been reached. We are effectively being DDoSed.”
-
25 May 2025
“Even when I give it a specific piece of code and probe/hint in the right direction, it produces five paragraphs of vulnerabilities, none of which are real”
-
29 May 2025
“I do think that for my fellow AI skeptics that we have been out voted in the industry tbh”
Katie Paxton-Fear Bug bounty hunter, API security researcher x.com
-
21 Oct 2026
“Most of the PoCs being posted are completely non-functional AI slop.”
Marcus Hutchins Malware researcher x.comCounterpoint
Meanwhile, a few early calls
-
2 Apr 2023
“AI will significantly diminish the difficulty of infosec, shedding light on the dark corners of IT configurations and making it harder for hackers to hide.”
Daniel Miessler Founder, Unsupervised Learning danielmiessler.comEarly call
-
8 Nov 2023
“I believe AI Agents will outhack humans.”
Joseph Thacker Bug bounty hunter josephthacker.comEarly call
Rung 2 of 5
A helper
Every finding gets verified
11 people · Jul 2023 to Jul 2026
-
31 Jul 2023
“AI augments human capabilities; it does not wholly replace human judgment and expertise.”
-
7 Sep 2023
“It took a few prompts to ensure it wasn’t hallucinating, and it did provide a few low-level bugs.”
-
10 Mar 2024
“These are still pretty small scale experiments on essentially toy programs”
Brendan Dolan-Gavitt Security researcher, NYU news.ycombinator.com
-
12 Mar 2024
“Don’t think it’ll replace us yet, but auditing got more accessible.”
-
20 Jun 2024
“current LLMs can really start to perform (admittedly rather basic) vulnerability research”
Google Project Zero Project Naptime googleprojectzero.blogspot.com
-
26 Jun 2024
“A lot of very subtle edge case conditions are not something the LLM is properly reasoning about so much as trying some things and maybe getting lucky.”
-
21 Apr 2025
“Without the diff of the patch, GPT would not have come close to being able to write a working proof-of-concept for it”
Matthew Keeley Security researcher, Platform Security theregister.com
-
22 May 2025
“If you’re an expert-level vulnerability researcher or exploit developer the machines aren’t about to replace you.”
Sean Heelan Exploit developer, after o3 found a kernel bug sean.heelan.io
-
3 Jul 2025
“But that's me, you know, using the AI sort of as a tool and my context is greater than the AI's context.”
Justin Gardner Bug bounty hunter, Critical Thinking podcast criticalthinkingpodcast.io
-
11 May 2026
“An amazingly successful marketing stunt for sure.”
Daniel Stenberg On Anthropic’s Mythos daniel.haxx.seCounterpoint
-
20 Jul 2026
“From my experience, this still requires a human in the loop.”
Andrew Hoffman Software and security architect andrewhoffman.meCounterpoint
Rung 3 of 5
It finds real bugs
On easier targets and simpler bug classes
14 people · May 2023 to Jun 2026
-
21 May 2023
“I gave ChatGPT a shot at it by copy-pasting from the etcd API documentation and asking it to find a vulnerability. It found it literally on the first try.”
-
16 Aug 2023
“I asked GPT-4 to audit the old version of src/crypto/pseudo_random.cpp in libbitcoin-explorer and it rediscovered the milk sad vulnerability haha”
-
5 Aug 2024
“I just learned that XBOW got as many solves as I did. I am shocked. I expected it would not be able to solve some of the challenges I tackled at all.”
Federico Muttis Pentester, after XBOW tied his score xbow.com
-
20 Oct 2024
“All of these vulnerabilities were not previously known or reported to the project maintainers,”
Dan McInerney Lead AI threat researcher, Protect AI theregister.comLab claim
-
Security1 Nov 2024
Google’s Big Sleep finds an exploitable SQLite bug, the first public AI-found flaw of its kind. projectzero.google
-
17 Apr 2025
“A few years ago, this process would have required specialized Erlang knowledge and hours of manual debugging. Today, it took an afternoon with the right prompts.”
Matthew Keeley Security researcher, Platform Security platformsecurity.com
-
1 May 2025
“I am increasingly worried that AI is going to be a good bug finder this year”
-
22 May 2025
“I wrote-up how I used o3 to find CVE-2025-37899, a remote zeroday vulnerability in the Linux kernel's SMB implementation.”
-
Jun 2025
“Therefore, we don't know if they are low-hanging fruits or sophisticated issues.”
Utku Şen Security researcher and tool author utkusen.substack.comCounterpoint
-
9 Jun 2025
“Today's hackbots … can maybe find 1% of vulnerabilities on a hardened live production application.”
-
Security24 Jun 2025
XBOW, an autonomous pentester, tops HackerOne’s US leaderboard. xbow.com
-
4 Aug 2025
“we have reported the first 20 vulnerabilities discovered using our AI-based”
Heather Adkins VP of Security Engineering, Google opensourceforu.comLab claim
-
18 Sep 2025
“They work extremely well. They find real vulnerabilities and logic bugs in minutes.”
-
Then7 May 2025
“A threshold has been reached. We are effectively being DDoSed.”
5months
Now10 Oct 2025
“Now this new breed, almost like a new category, of analyzers that seem to connect the dots better and see patterns previous tools and analyzers have not been able to.”
-
26 Jun 2026
“It worked remarkably well; I found a few real vulnerabilities and reported them to the ClickHouse bug bounty program.”
Tsvetan Stoychev Former principal engineer, Akamai clickhouse.com
-
30 Jun 2026
“Using Claude Code, I was able to get XSS on www.redacted.com (one of the most well-known domains).”
Justin Gardner Bug bounty hunter, Critical Thinking podcast yeswehack.com
Rung 4 of 5
It finds most of the bugs
More than the humans do
13 people · Aug 2025 to Oct 2026
-
6 Aug 2025
“I'm already losing count”
Mikko Hyppönen Chief research officer, Sensofusion itbrew.com
-
18 Sep 2025
“it literally found hundreds of real vulnerabilities and bugs in very critical software”
-
8 Feb 2026
“do not bet against LLMs on this”
-
18 Feb 2026
“AI vulnerability finding is changing cybersecurity, faster than expected.”
Bruce Schneier Security technologist, Harvard Kennedy School schneier.com
-
27 Feb 2026
“We're finding more bugs in a week than we used to find in a month.”
-
Mar 2026
“I have never found one of these in my life before.”
Nicholas Carlini Research scientist, Anthropic mtlynch.ioLab claim
-
26 Mar 2026
“Something happened a month ago, and the world switched. Now we have real reports.”
Greg Kroah-Hartman Linux stable kernel maintainer theregister.com
-
Then31 Jul 2023
“AI augments human capabilities; it does not wholly replace human judgment and expertise.”
32months
Now31 Mar 2026
“we went from finding about 15 bugs a week to 200.”
-
3 Apr 2026
“Now most of these reports are correct, to the point that we had to bring in more maintainers to help us”
Willy Tarreau HAProxy lead, Linux kernel security team simonwillison.net
-
11 Apr 2026
“LLMs have now bypassed human capability for bug finding”
-
Then2 Jan 2024
“we're soon to see a top reason security issues don't get fixed will be because they are lost in the sea of LLM generated nonsense bug bounty reports.”
27months
Now28 Apr 2026
“AI can do more than find vulns in source code.”
-
11 Oct 2026
“The big open question is: Are we witnessing the vulnpocalypse or the bugocide?”
-
22 Oct 2026
“within the last few months, we have received hundreds of vulnerability reports submitted to curl and every single one had AI involved to some extent”
Rung 5 of 5
It finds and exploits alone
Humans barely check
12 people · Jun 2025 to Sep 2026
-
24 Jun 2025
“All findings were fully automated”
Nico Waisman Head of security, XBOW techrepublic.comLab claim
-
Aug 2025
“Our most ambitious approach gives LLMs full autonomy.”
Taesoo Kim Team Atlanta, AIxCC winners team-atlanta.github.io
-
18 Jan 2026
“The limiting factor on a state or group’s ability to develop exploits, break into networks… is going to be their token throughput”
-
3 Apr 2026
“You can’t design a better problem for an LLM agent than exploitation research.”
-
Security7 Apr 2026Lab claim
Anthropic: models now “surpass all but the most skilled humans” at finding and exploiting vulnerabilities. anthropic.com
-
7 Apr 2026
“Mythos can chain multiple low and medium vulns together to create a high or critical. This is a task that far less than 1% of cybersecurity experts have ever done.”
Daniel Miessler Founder, Unsupervised Learning danielmiessler.com
-
11 Apr 2026
“now they are far more easy to exploit by a far broader variety of potential adversaries”
-
13 Apr 2026
“Last month, I launched Claude on a private program one evening. By the next morning, it had found me about ten bugs. Without me doing anything.”
-
24 Apr 2026
“As usual for this series, Claude found the bug and wrote the exploit on its own”
-
Then9 Jun 2025
“Today's hackbots … can maybe find 1% of vulnerabilities on a hardened live production application.”
13months
Now1 Jul 2026
“it became feasible for any skilled hacker to scale up a hacking agent, spending hundreds in token cost to find thousands in bounties.”
-
Then17 Mar 2023
“It couldn't do it. No matter how I crafted the prompts, it couldn't come up with the deep, technical response I was alluding to.”
40months
Now23 Jul 2026
“remove ourselves from the loop even more and enable the AI to do its own thing and find these bugs autonomously.”
Justin Gardner Bug bounty hunter, Critical Thinking podcast criticalthinkingpodcast.io
-
Then5 Nov 2024
“We're not there yet. We're not even remotely there yet. But it's a reasonable extrapolation.”
21months
Now11 Aug 2026
“If there is any vulnerability in anything, AIs are going to find and exploit them.”
Bruce Schneier Security technologist, Harvard Kennedy School schneier.com
-
Sep 2026
“Opus 5 turned it into a working image-upload exploit with ASLR on.”