I’ve been doing a lot of thinking about this over the past week. It’s getting very easy to become complacent and let AI do everything for us, especially when we’re all being pushed to 10x our output. It can be hard to justify spending hours getting into the low-level details when a model can often get you most of the way there in seconds. A lot of respected practitioners have already raised concerns about skill deterioration, and I think they’re right to worry about it. At the same time, AI is going to make software meaningfully more secure. As more companies integrate strong AI code scanning directly into CI/CD, a lot of low-hanging fruit is going to disappear. Even harder memory corruption bugs, unsafe API use, obvious authorization problems, and common implementation mistakes are going to get caught earlier and more consistently. That’s of course a very good thing. But I don’t think vulnerability research or hacking suddenly ends. The offense adapts, and the bar rises. That's always been the "fun" part for those of us in the offensive space. I’ve spent a lot of time lately benchmarking what AI code scanning and dynamic sandbox analysis are good at, and I think the harder problems increasingly move toward things like business logic flaws, strange state-machine behavior, race conditions, cross-service trust mistakes, authorization failures that only emerge across multiple components, protocol composition issues, and distributed-system behavior. I've been trying to write CTF challenges for learning that capture this. And then we’re adding entirely new attack surfaces like agents, tool use, model orchestration, persistent memory, agent-to-agent communication, and systems where one AI is implicitly trusting the output or state of another. AI will continue to help researchers explore these systems at a scale humans never could before. That probably means we’ll discover failure modes and bug classes that we haven’t even thought of yet. Which is why I think it’s more important now, not less, for people to keep putting in the work to understand how things actually work underneath. I catch myself taking the easy route with AI more often than I’d like. Fortunately, I’ve spent thousands of hours coding, debugging, reversing, exploiting, and generally fighting with systems, so I can still drop back down into the weeds when I need to. Thankfully, there are a lot of us in this pool. What worries me more is the next generation coming into the industry. How do they build that same intuition if AI removes so much of the struggle that used to force us to learn? There are fewer intern spots, fewer junior positions, etc... Because if you don’t understand what’s happening underneath, it becomes much harder to know when the AI is wrong, when a finding is overstated, how to properly validate an issue, how to turn odd behavior into a real vulnerability, or how to recognize an entirely new bug class. Vulnerability research has never really been about instant gratification. It takes time, patience, creativity, failure, and a certain amount of stubbornness. AI absolutely makes us faster. We should use it. We just shouldn’t let it make us stop thinking. My current belief is that both offense and defense are going to level up dramatically. Software will get more secure, but researchers and attackers will get more capable too. The bugs that matter will simply become harder, stranger, and more interesting. As a historically offensive practitioner that's exciting to me as it's curiosity that brought many of us into this space. I swear I reread this 10 times worried that it sounds like AI wrote it. I promise it didn't. :) My hope with this tweet is that it encourages those coming into the space, or who are new to the space, to put the work in to learn as much as you can. One thing that attracted many of us to this space is the challenges with solving complex puzzles. I encourage you to go back and read Hacking: The Art of Exploitation... .The Shellcoder's Handbook, and selfishly, the Gray Hat Hacking series! Sorry for the looooooooooooong tweet.