20/04/2026
AI and Vulnerability Discovery:
Why โHuman In The Loopโ is more important now than ever
The release of Anthropic's Mythos and OpenAI's GPT-5.4-Cyber has brought a lot of attention to what AI can now do in security. Finding vulnerabilities at scale across operating systems and browsers is a genuine capability step forward, and the technology behind it will only improve.
But capability is not the same as coverage. AI is becoming increasingly effective at identifying known vulnerability classes and improving the quality of generated code.
๐๐ก๐๐ญ ๐ข๐ญ ๐๐จ๐๐ฌ ๐ง๐จ๐ญ ๐๐จ ๐ข๐ฌ ๐๐ฉ๐ฉ๐ซ๐จ๐๐๐ก ๐ ๐ฌ๐ฒ๐ฌ๐ญ๐๐ฆ ๐ญ๐ก๐ ๐ฐ๐๐ฒ ๐๐ง ๐๐ญ๐ญ๐๐๐ค๐๐ซ ๐๐จ๐๐ฌ. It does not probe boundaries looking for unexpected behaviour, identify how a chain of low-severity findings can be combined into something critical, or draw on years of heuristic experience across different targets and environments.
As AI accelerates both development and automated security tooling, that ๐จ๐ฎ๐ญ๐ฌ๐ข๐๐-๐ข๐ง ๐ฉ๐๐ซ๐ฌ๐ฉ๐๐๐ญ๐ข๐ฏ๐ ๐๐๐๐จ๐ฆ๐๐ฌ ๐ฆ๐จ๐ซ๐ ๐ข๐ฆ๐ฉ๐จ๐ซ๐ญ๐๐ง๐ญ, not less. The speed at which software is now being written, much of it AI-assisted, means the attack surface is growing faster than automated tools can meaningfully assess it.
โHuman In The Loopโ is not a fallback for when automated tools reach their limit. In a landscape where AI is accelerating both how software is built and how it is attacked, ๐ก๐๐ฏ๐ข๐ง๐ ๐๐ฑ๐ฉ๐๐ซ๐ข๐๐ง๐๐๐ ๐ฉ๐๐จ๐ฉ๐ฅ๐ ๐ฐ๐ก๐จ ๐ฎ๐ง๐๐๐ซ๐ฌ๐ญ๐๐ง๐ ๐๐ญ๐ญ๐๐๐ค๐๐ซ ๐๐๐ก๐๐ฏ๐ข๐จ๐ฎ๐ซ ๐๐ง๐ ๐๐๐ง ๐ญ๐ก๐ข๐ง๐ค ๐๐๐ฒ๐จ๐ง๐ ๐ญ๐ก๐ ๐ ๐ฎ๐๐ซ๐๐ซ๐๐ข๐ฅ๐ฌ themselves is what separates a thorough assessment from a false sense of security.
At Pentest Cyber, ๐ญ๐ก๐๐ญ ๐ข๐ฌ ๐ฐ๐ก๐๐ญ ๐ฐ๐ ๐ฉ๐ซ๐จ๐ฏ๐ข๐๐. If you want to understand what your systems look like from an attacker's perspective, ๐ ๐๐ญ ๐ข๐ง ๐ญ๐จ๐ฎ๐๐ก.
www.pentestcyber.co.uk
[email protected]
