The Asymmetric Defense

AI agents are already finding vulnerabilities faster than humans can patch them — self-reinforcing white-hat systems may be the only viable counterforce

Deep Dive · Next AI Labs · Human-Agent Research · 15 min read

The attack surface is growing faster than human defenders can cover it.

This isn't speculation. In February 2026, Anthropic's Claude Opus 4.6 found over 500 previously unknown zero-day vulnerabilities in open-source software — using only out-of-the-box capabilities. No specialized training. No custom security prompts. Just an AI model with access to Python, fuzzers, and debuggers, reasoning about code in a sandbox. When traditional analysis tools failed on one target, Claude invented a novel approach by mining the project's git commit history for clues.

Five hundred real vulnerabilities. Validated by security researchers. Found in weeks.

Now consider: the same capability is available to anyone with an API key.

The Risk Surface That Outpaces Us

Software systems are growing more complex, more interconnected, and more valuable as targets. The attack surface expands with every new protocol deployed, every smart contract upgrade pushed, every dependency added to a supply chain. Human security researchers — even brilliant ones — are constrained by time. A senior auditor can deeply analyze 2-3 codebases per month. There are thousands of new targets every week.

The traditional defense model relies on a scarce resource: expert human attention. Bug bounty platforms like HackerOne paid $81 million in bounties in 2025, a 13% year-over-year increase. The broader security market is projected to reach $5.7 billion by 2033. These numbers reflect growing investment in defense. They also reflect a growing gap between the volume of vulnerable code and the humans available to find the vulnerabilities.

AI agents change this equation — for both sides.

An adversarial agent doesn't need to be creative. It needs to be relentless. It can scan thousands of contracts, try millions of input combinations, probe every exposed endpoint — at a cost of pennies per attempt. The offense-defense asymmetry that has always favored attackers (they only need to find one vulnerability; defenders need to find all of them) is being amplified by automation.

This is the landscape we're looking at. Not a future scenario. The present.

Why Self-Reinforcing Defense Matters

The only viable response to AI-powered offense is AI-powered defense. But not just any AI defense. A scanner that runs the same checks every day doesn't keep pace with evolving threats. A one-shot audit doesn't protect against post-deployment changes. The defense needs to be self-reinforcing — a system that gets genuinely smarter over time.

This is where compound learning becomes critical.

A self-reinforcing defense agent doesn't just scan code. It accumulates expertise. Every false positive it flags and a human corrects becomes a persistent lesson: "This pattern looks like reentrancy but isn't — the state update precedes the external call. This is the checks-effects-interactions pattern." Every confirmed vulnerability becomes a template: "This access control gap in a lending protocol's interest rate function? Look for it in every lending protocol that upgrades."

Over months, the agent has analyzed hundreds of codebases. It knows which patterns are dangerous and which are benign. It knows where developers commonly make mistakes in specific categories of systems. This is alignment feedback loop applied to security — each human correction aligns the agent more precisely with what constitutes a real threat versus noise.

The critical insight: this is the same architecture we use for human-agent alignment in other domains. The mechanism that teaches an agent "this user prefers dismissable modals over hard redirects" is structurally identical to the mechanism that teaches an agent "this Solidity pattern looks like a vulnerability but is actually a standard safety check." The persistence layer is the same. The correction-to-knowledge pipeline is the same. The compound improvement over time is the same.

The infrastructure for self-improving defense agents already exists. It was built for a different purpose — aligning AI agents with human intent in product development. But the architecture transfers directly.

The Autonomous Researcher Model

The model we find most compelling isn't the brute-force scanner. It's the autonomous researcher — an agent that works independently, accumulates domain expertise, and escalates to human judgment only when it has high-confidence findings worth reviewing.

The human provides what humans are uniquely good at: deciding whether a flagged issue constitutes a real vulnerability in context, crafting the proof-of-concept that demonstrates exploitability, and exercising the ethical judgment about responsible disclosure. These are not tasks you automate away. They're the reason the system stays aligned.

The agent provides what agents are uniquely good at: tireless analysis of thousands of lines of code, tracing fund flows through nested contract interactions, checking access control modifiers on every external function, and remembering every pattern it has ever analyzed. Scale without fatigue. Memory without decay.

The daily operation:

┌─────────────────────────────────────────────────────┐
│                                                     │
│  1. TARGET SELECTION                                │
│     Monitor for new deployments and upgrades.       │
│     Prioritize by risk exposure vs. audit coverage. │
│                           │                         │
│                           ▼                         │
│  2. SOURCE ACQUISITION                              │
│     Pull verified source. Map dependencies          │
│     and external call surfaces.                     │
│                           │                         │
│                           ▼                         │
│  3. DEEP ANALYSIS                                   │
│     Read every function. Trace fund flows.          │
│     Check access controls. Model attack vectors.    │
│                           │                         │
│                           ▼                         │
│  4. SELF-FILTER                                     │
│     Compare against accumulated knowledge.          │
│     Check known-benign patterns. Reduce noise.      │
│                           │                         │
│                           ▼                         │
│  5. ESCALATE (HIGH-CONFIDENCE ONLY)                 │
│     Surface to human only when confidence exceeds   │
│     threshold. Include full reasoning chain.        │
│                                                     │
└─────────────────────────────────────────────────────┘

This isn't a replacement for human security expertise. It's an amplifier. The human's judgment becomes the training signal for an ever-improving system. The system's tireless scanning becomes the human's extended reach across a threat landscape too vast for any individual to cover.

Where AI Agents Have Genuine Advantage

Being honest about capability boundaries matters here — especially because the alternative is the kind of AI hype that erodes trust. Multiple programs have already been damaged by floods of low-quality AI-generated security reports. Curl killed its entire bug bounty program in 2025 because of AI slop. Quality isn't optional.

Here's where LLM-based agents have genuine advantage over both traditional automated tooling and unaided human researchers:

Logic errors in business logic. Static analysis tools find known vulnerability patterns. LLMs can reason about whether business logic does what the developer intended. "This function allows the admin to set the fee to 100%, which would drain the pool" isn't a code pattern — it's reasoning about intent versus implementation.

Access control gaps. Who can call which function, under what conditions, and what's the worst-case outcome if the wrong party gains access. This is reasoning about permission surfaces, not pattern matching.

Economic attack vectors. Flash loan attacks, oracle manipulation, sandwich attacks — these require understanding how protocols interact with external systems and markets. This is multi-step causal reasoning, exactly the kind of analysis that Opus 4.6 demonstrated in its zero-day research.

Post-upgrade vulnerabilities. This may be the most important category. Protocols get audited once at launch, then add new code. The new code hasn't been professionally reviewed. An agent monitoring for upgrades and scanning the delta is looking exactly where professional auditors aren't — in the gap between audits.

Where the agent is weaker:

Novel attack categories. Truly creative attack vectors that nobody has documented. These require genuine invention, and current agents apply known patterns rather than inventing new ones.

Deep protocol-specific intent. Understanding what a protocol is supposed to do requires context beyond the source code — documentation, founder intent, community expectations.

On-chain state reasoning. Some vulnerabilities only manifest with specific blockchain state. Source code analysis alone can miss bugs that depend on live conditions.

The Gap in the Defense Line

The top 50 protocols by total value locked have been audited by 3-4 professional firms each. Trail of Bits, OpenZeppelin, Spearbit, Consensys Diligence — senior security engineers charging $50,000-$500,000 per engagement. These protocols are well-defended.

But the next 200-500 protocols? The mid-tier projects with meaningful value locked and active users, but without the budget for multiple professional audits? This is long tail targeting applied to defense — focusing protection on the parts of the ecosystem that need it most and currently have the least.

These protocols often have:

• One professional audit at launch, with no re-audit after subsequent upgrades
• Custom implementations of standard patterns that introduce novel bugs
• Less scrutiny from the security research community, because the top researchers focus on the highest-profile targets

This isn't just an opportunity. It's a gap in the defense line. Real users have real funds in these protocols. An aligned defense system monitoring this long tail provides protection that wouldn't otherwise exist.

The Sustainability Question

A defense system that requires perpetual funding without generating its own sustainability is fragile. It depends on grants, donations, or corporate goodwill — all of which fluctuate with market conditions and institutional priorities.

This is where the bug bounty model becomes relevant — not as a primary motivation, but as a sustainability mechanism.

The economics are genuinely favorable for aligned defense. Immunefi has paid out over $100 million in total bounties, with 77.5% ($78 million) going to smart contract vulnerabilities. The highest single payout was $10 million for a vulnerability in Wormhole's cross-chain protocol. Critical findings typically pay 10% of funds directly at risk.

A company called XBOW tested the limits of AI-powered bounty hunting at scale. They raised $117 million, reached #1 on HackerOne in 90 days with over 1,060 vulnerability submissions, and are still operating at a loss — inference costs exceed earnings. But XBOW's economics reflect a company with engineering salaries, investor expectations, and platform-building overhead.

For a self-reinforcing defense agent running at $200-$600 per month in inference costs — with no salaries, no office, no investor expectations — the economics are fundamentally different. This is an asymmetric bet: bounded downside, unbounded upside. A single valid finding can fund years of continued operation.

Stanford's BountyBench benchmark showed top AI agents detecting novel vulnerabilities at a 12.5% success rate. The CAI framework demonstrated 11x speed and 156x cost savings compared to human teams. Multi-agent orchestration capabilities that launched in early 2026 suggest these numbers will improve.

The point isn't that defense is profitable. The point is that defense can be self-sustaining. A system that pays for its own operation through the vulnerabilities it prevents from being exploited is more durable than one that depends on external funding. The economics align the incentives: finding bugs before adversaries do is both the mission and the mechanism for continuing the mission.

The Alignment Lesson

We study human-agent alignment because we believe the most important question of this decade isn't "what can AI agents do?" It's "what should they do, and how do we ensure they keep doing it?"

An autonomous researcher defending software systems is alignment in practice — not theory, not benchmarks, but a system where agent capability is directed by human values and human judgment remains the final authority.

The agent doesn't decide what constitutes responsible disclosure. The human does. The agent doesn't decide which findings are worth reporting. It surfaces candidates; the human decides. The agent doesn't set its own objective function. It improves within boundaries defined by human correction.

This is what aligned AI looks like in the real world: agents that amplify human capability without replacing human judgment. Systems that get smarter through human feedback rather than despite it. Technology that creates a generative counterforce to the genuine risks that the same technology introduces.

The attack surface will keep growing. AI agents will keep getting more capable — on both sides of the line. The question is whether the defense compounds as fast as the offense. Self-reinforcing systems, grounded in human oversight and sustained by their own output, may be the best answer we have.

What We Still Don't Know

These are real open questions, not performative humility:

1. Can LLM agents find vulnerabilities that professional human auditors missed? The Opus 4.6 results are encouraging — 500+ zero-days in C/C++ code. But smart contract security is a different domain with different vulnerability classes, and DeFi protocols have been specifically designed with security in mind. Large-scale evidence of AI finding what human auditors missed is still emerging.

1. Does the compound learning loop converge or diverge? Our experience with alignment feedback loops in product development shows clear improvement over time. But security is a domain where the distribution shifts — new vulnerability classes emerge, protocols evolve, and yesterday's patterns may not apply to tomorrow's targets. The agent may need to unlearn as much as it learns.

1. How do disclosure platforms respond to AI-assisted findings at scale? HackerOne now requires human-in-the-loop for AI submissions and has split its leaderboards. Immunefi hasn't publicly addressed AI-assisted submissions at scale. Platform policy will shape the viability of this model.

1. Is the long tail genuinely underdefended, or just lower-value? Our assumption is that mid-tier protocols have meaningful risk exposure but insufficient audit coverage. This might be wrong — the audit coverage might be low because the attack surface is small. We haven't validated this with data.

1. What's the false positive cost to trust? Security platforms are reputation systems. An agent that submits low-quality reports damages the credibility of AI-assisted defense broadly. Quality standards are non-negotiable — the curl incident proved this.

1. Can the defense compound faster than the offense? This is the fundamental question. If adversarial agents improve faster than defensive agents, the asymmetry widens. If defensive agents can leverage responsible disclosure pipelines, community knowledge, and cumulative expertise, they may have a structural advantage. We don't know yet which side the compounding favors.

The strongest version of this idea isn't "use AI to find bugs and collect bounties." It's "build a self-reinforcing defense system that compounds security expertise over time, focused on the parts of the ecosystem that need protection most." The infrastructure for self-improving agents exists. The threat landscape demands it. The economics make it sustainable. Whether we build it — and build it aligned — is a choice we're making right now.