AI tools expose 40 years of legacy software debt, experts say

Experts note that AI excels at the complex reasoning required to find specific memory errors that humans often ignore. Suman Jana of Columbia University argues that while AI cannot do everything alone, it significantly boosts the capabilities of top security experts. This creates a fundamental asymmetry: finding bugs is becoming faster and easier, while fixing them remains difficult and slow, especially for open-source projects without dedicated funding. The PHP Foundation spent two months developing a patch after the exploit was disclosed.

The debate continues on how to address this growing threat. Some researchers suggest that frontier AI labs should donate more compute resources to security efforts and that formal verification tools can help automate patching. Others, like Matthew Green from Johns Hopkins, remain skeptical, predicting that significant industry change will only occur after a major, damaging breach happens. For now, the consensus is that legacy software is increasingly vulnerable to AI-assisted attacks.