Whew. I'm so glad I am no longer working and don't have to sit through all the meetings after meetings after meetings discussing critical subjects like this!
Who stands between the attacker and the unpatched pump for ten years? Shields buy time, but somebody still has to notice the chain. (I'm at Stellar Cyber.)
Thank you so much for the detailed article!!! Formal verification is definitely a great tool to eliminate entire bug classes, and I think it's getting dramatically faster. SMT-based formal verification has been automated from the beginning, though it’s still slow due to the inefficiencies of bit-vectors. Meanwhile, the other approach, interactive theorem proving, is improving fast. Lean4-style theorem proving was not popular before since we human needed to write the proof by hand. However, in 2026, we can just ask AI to write those proofs, and now an "interactive theorem prover" is mostly automated.
the industrial control systems bit is the one I'd underline, and it made me think of Onodrim who just raised $300m to buy up European defence and industrial manufacturers, because if those factories are running controllers that only get patched once a year then the cyber side might be one of the first things a buyer like that has to sort out
Anthropic's unreleased model winning a Linux race that Red Hat rated moderate in under an hour is the new clock. Severity that assumes a human needs days to win a timing race goes stale the moment a model tries it, so the compensating control has to land before the exploit write-up does.
The number that sticks is the 43-day median full remediation against exploits that can be assembled in hours. The PHP week is the concrete case: edge providers could block while the underlying installs stayed open, and 2.6–4.4 million installs outside that umbrella stayed exposed. I would treat "can someone stand between the attacker and the bug" as a first-class control, not a temporary patch. Otherwise every unfixed package is just waiting for the next model that wins the race condition in under an hour.
The gap in this piece is the one to sit with: exploits take hours, fixes take weeks, and the answer is to ship fixes at machine speed too. But a bad fix shipped at machine speed is self-inflicted harm. So the checking has to travel at the same speed as the fix. And a growing share of breaches now start with a vendor — whose risk still sits with the buyer. https://aideliverybrief.substack.com/p/mas-says-a-vendors-ai-is-still-your
Whew. I'm so glad I am no longer working and don't have to sit through all the meetings after meetings after meetings discussing critical subjects like this!
Think you accidentally neglected to name a certain load-bearing co-author on this one, I work with him too
Who stands between the attacker and the unpatched pump for ten years? Shields buy time, but somebody still has to notice the chain. (I'm at Stellar Cyber.)
Thank you so much for the detailed article!!! Formal verification is definitely a great tool to eliminate entire bug classes, and I think it's getting dramatically faster. SMT-based formal verification has been automated from the beginning, though it’s still slow due to the inefficiencies of bit-vectors. Meanwhile, the other approach, interactive theorem proving, is improving fast. Lean4-style theorem proving was not popular before since we human needed to write the proof by hand. However, in 2026, we can just ask AI to write those proofs, and now an "interactive theorem prover" is mostly automated.
the industrial control systems bit is the one I'd underline, and it made me think of Onodrim who just raised $300m to buy up European defence and industrial manufacturers, because if those factories are running controllers that only get patched once a year then the cyber side might be one of the first things a buyer like that has to sort out
Anthropic's unreleased model winning a Linux race that Red Hat rated moderate in under an hour is the new clock. Severity that assumes a human needs days to win a timing race goes stale the moment a model tries it, so the compensating control has to land before the exploit write-up does.
The number that sticks is the 43-day median full remediation against exploits that can be assembled in hours. The PHP week is the concrete case: edge providers could block while the underlying installs stayed open, and 2.6–4.4 million installs outside that umbrella stayed exposed. I would treat "can someone stand between the attacker and the bug" as a first-class control, not a temporary patch. Otherwise every unfixed package is just waiting for the next model that wins the race condition in under an hour.
The gap in this piece is the one to sit with: exploits take hours, fixes take weeks, and the answer is to ship fixes at machine speed too. But a bad fix shipped at machine speed is self-inflicted harm. So the checking has to travel at the same speed as the fix. And a growing share of breaches now start with a vendor — whose risk still sits with the buyer. https://aideliverybrief.substack.com/p/mas-says-a-vendors-ai-is-still-your