How Long Until AI Hacks Everything?

The question nobody in cybersecurity can confidently answer

For decades, the balance of power in computer security has rested on a simple asymmetry: finding a serious flaw in complex software is hard, slow work that demands expertise, patience, and a certain obsessive temperament. Defenders have always been outnumbered, but attackers have been throttled by the same bottleneck — there are only so many people in the world who can reliably break into things.

Artificial intelligence threatens to dissolve that bottleneck. If machines can read code, reason about it, and discover the subtle mistakes that lead to exploitable vulnerabilities, then the supply of attacking talent stops being a human constraint and becomes a computing one. The question raised by the headline above is not whether that moment arrives, but how soon — and what the world looks like on the other side of it.

Why this is different from past automation

Security has used automation for years. Scanners, fuzzers, and static analysis tools already churn through software looking for weaknesses. What is new is the prospect of systems that can do the parts that previously required judgment: understanding what a program is supposed to do, imagining the circumstances in which it fails, chaining several small weaknesses into one serious breach, and then writing working code to take advantage of it.

That capability, if it matures, scales in a way human expertise never could. A single skilled intruder can target one organization at a time. A capable automated system could, in principle, be pointed at thousands simultaneously — or at the shared software libraries that sit underneath nearly everything, from hospital systems to power grids to the apps on your phone.

The defenders get the same tools

The optimistic counterargument is straightforward: the technology is symmetric. Whatever helps an attacker find a flaw also helps a vendor find it first and patch it. Software has been accumulating decades of undiscovered bugs; a tool that surfaces them at scale could, over time, leave the world’s code substantially more secure than it has ever been. Some researchers argue this is precisely the opportunity — a chance to pay down a vast, invisible debt of insecure code.

The pessimistic reply is about timing and friction. Discovering a flaw is fast; fixing one is slow. Patches must be written, tested, shipped, and — the hardest part — actually installed by users and organizations that are busy, under-resourced, or simply unaware. Much of the world’s critical infrastructure runs on systems that are old, poorly documented, and difficult to update without taking something important offline. If offense accelerates and defense does not, the gap between the discovery of a weakness and its repair becomes the most dangerous window in modern technology.

What “everything” would actually mean

Talk of AI hacking “everything” invites images of sudden, total collapse. The more plausible scenario is grindingly incremental: more breaches, cheaper ransomware, more convincing fraud, a steady erosion of the assumption that digital systems can be trusted. The damage would show up not as a single catastrophe but as a rising cost paid by everyone.

That makes the timeline question less useful than it sounds. The meaningful work — hardening critical systems, shortening patch cycles, deciding what capabilities should be restricted and by whom — is worth doing regardless of whether the reckoning arrives in two years or ten. The uncomfortable truth is that nobody knows which it will be, and the institutions that would need to prepare tend to move on a schedule of their own. Read More