Going Dark, but for Attackers: How AI Bug Hunting Could Shrink the Exploit Market

Picture this: you’re standing in line for coffee after a security conference, and every conversation is either about encryption or about models that can write code. That mood doesn’t feel surprising—security people live in those two universes. But lately there’s been a third thread quietly pulling them together: vulnerability discovery.

That’s where the phrase “going dark” comes in—not as a poetic warning, but as a practical one. “Going dark” has traditionally meant law enforcement losing access to communications and devices as security improvements roll out. Now there’s a twist: if AI accelerates defense too well, the “darkness” could also fall over attackers and intelligence exploiters.

This post walks through why.

What “going dark” really means in practice

Law enforcement’s classic problem is straightforward: when evidence lives inside modern technology, it can become unreadable without either the device owner’s help or a successful exploit.

Two technical shifts made that problem harsher:

1. Smartphones became data vaults. Instead of only transmitting voice or short messages, phones store lots of actionable material—contacts, photos, chat logs, browsing history.
2. Encryption tightened the vault. Modern phones increasingly encrypt data at rest (when stored) and secure messaging end-to-end.

Let’s define the key terms before they get slippery.

• End-to-end encryption (E2EE): messages are encrypted on the sender’s device and only decrypted on the recipient’s device. Intermediaries (including the service provider) can’t read the content in transit.
• Encryption at rest: stored data is encrypted so that reading the raw storage doesn’t reveal meaningful content.
• Data at rest keys derived from a passcode: on many platforms, unlocking isn’t “handy access.” It’s literally how the encryption key becomes available.

When systems move toward these designs, a warrant can still compel the device, but it can’t compel the math. If the only practical decryption key is the user’s passcode (or its hardware-backed equivalent), then the provider can’t “just turn it off.”

That’s the technical backbone beneath the policy debate around “going dark.” It’s not that law enforcement stopped caring. It’s that the attack surface for lawful access narrowed.

The old model: keep an offensive edge

Before AI bug hunting became mainstream, many offensive capabilities looked like they depended on asymmetric advantage: attackers (including state-linked groups and their suppliers) could find or maintain the edge on vulnerabilities faster than defenders could discover and patch.

Even when vulnerabilities were fixed quickly, there was a window:

• A new vulnerability appears.
• Someone finds it (often privately).
• Exploit techniques turn it into a usable intrusion path.
• Defenders eventually patch, but not instantly.

That window mattered.

And for years, law enforcement and intelligence communities could rely on tools purchased from specialized vendors or enabled by teams that discovered vulnerabilities first. Targeted phone unlocking systems became an entire product category. Separately, mobile spyware vendors demonstrated real-world exploitation chains, including “zero-click” styles where the target doesn’t actively click anything.

The details differ from case to case, but the economics rhyme: offensive capability often depends on scarce opportunities.

Enter AI: faster vulnerability discovery, earlier patching

Now we’re in the phase where AI is changing the speed and scale of security work.

The simplest way to say it: AI systems that can reason about code and generate exploit strategies reduce the time between “bug exists” and “bug is understood.”

That matters because defense is mostly a workflow problem, not a willpower problem.

Three things happen when AI raises the rate of vulnerability discovery:

1. More bugs get found. Not all bugs are equally important, but even a partial uplift changes the totals.
2. Finding turns into triage faster. Triage is the act of deciding which reports matter and how risky they are.
3. Patching gets moved earlier. Instead of waiting for humans to discover issues late in the lifecycle, teams increasingly bake scanning into CI pipelines.

A CI toolchain (continuous integration toolchain) is the automated set of steps that builds, tests, and checks code every time it’s updated. When AI-driven scanning runs there, vulnerabilities are caught before a human ever touches a release candidate.

A concrete example: “Mythos” and the export-control drama

In 2026, Anthropic’s Claude Mythos initiative became one of the public signals that the vulnerability-finding era had shifted into a higher gear.

• A Mythos preview (part of a cybersecurity initiative often described as Project Glasswing) was introduced on April 7, 2026.
• Soon after, the U.S. government directed a suspension of access to both Fable 5 and Mythos 5 for foreign nationals (announced June 12, 2026).
• That suspension was later lifted, with export controls removed by June 30 / July 1, 2026, depending on platform rollout timing.

Even if you ignore the policy theater, the signal is technical: “frontier models” weren’t merely writing essays about security—they were being used to find and discuss serious software weaknesses.

Another example: Daybreak and the defensive loop

OpenAI’s Daybreak program frames the defensive story explicitly: AI helps find, validate, and fix vulnerabilities—not only report them.

Daybreak bundles frontier cyber models with defensive workflows and partner ecosystems, with emphasis on ensuring validated findings translate into patches that actually land.

In other words, this isn’t only about discovering more bugs. It’s about shrinking the time from bug to remediation.

That shrinking time is the enemy of the exploit window.

Why this could make attackers “go dark” too

Here’s the perverse part: AI can be extremely good for defense while still producing a bleak outcome for offensive capability.

The traditional offensive advantage depended on defender lag. Once AI shortens the gap, several things become harder:

• Privately held vulnerabilities lose value if defenders can discover similar issues sooner.
• Reliability of exploits drops when patches roll out across widely used components.
• Residual “remotely exploitable bugs” shrink as maintainers harden codebases and re-run scanning more aggressively.

At some point, defenders don’t merely catch up. They can reach a ceiling where many of the “useful” vulnerabilities in well-maintained software become rare.

That sounds like a Utopian headline, but it creates an asymmetric outcome:

• Offense doesn’t disappear.
• But the market for exploitable bugs narrows.

For law enforcement and intelligence groups that historically depended on a continuing flow of advanced, targeted exploitation opportunities, that narrowing can look like a capability loss—“going dark” in a different direction.

The tricky detail: the world won’t be perfectly patched

Security folks already know this, but it’s worth stating plainly: software never becomes perfectly secure.

Even if AI-driven scanning accelerates patching, there will still be:

• Legacy systems that can’t be upgraded quickly.
• Misconfigurations that don’t require a “bug” at all to create risk.
• Supply-chain complexity where code paths are assembled from many sources.
• New vulnerabilities that emerge faster than any single workflow can eliminate them.

So “going dark” here shouldn’t be read as “nobody can hack anymore.” It’s better read as “the easiest high-value targets become scarcer.”

And scarcity matters. If a capability requires fresh exploitation opportunities—and those opportunities are being found and patched faster than they can be monetized—then even well-funded offensive operations can experience a sustained reduction in practical effectiveness.

The deeper shift: security becomes a continuous arms race of throughput

One reason this feels like a turning point is that it’s not a shift in security ideas—it’s a shift in throughput.

• Defense gains parallelism: more code reviewed, more reports generated, more fixes validated.
• Offense gains parallelism too, but it also suffers once the world hardens.

That creates a strange feedback loop:

1. AI makes it cheaper to find vulnerabilities.
2. Defenders deploy AI-based scanning and repair workflows.
3. Exploit windows shrink.
4. Attackers must spend more effort to reach equivalent outcomes.

Eventually, the cost curves change enough that the old playbook—maintain an offensive advantage through slower defensive discovery—becomes less viable.

The real takeaway

The “going dark” story has always been about encryption tightening what providers can read. That’s the public-facing part.

The emerging story is about vulnerability discovery becoming faster and more broadly automated—so that attackers may start facing their own kind of darkness, not because they’ve been prevented from acting, but because the raw exploitable surface hardens.

Software security won’t become magic. But the exploit economy could become less forgiving, especially for well-maintained platforms where patches actually land.

And that’s a technical change worth noticing: when defense throughput rises, the attack window closes first.