Hajra Naz
Cryptography professor Matthew Green sparked a debate with a controversial post and blog entry. The content quickly went viral across the cybersecurity community.
Green analyzes the balance between government hacking tools and user privacy through strong encryption. He proposed a thought-provoking scenario regarding artificial intelligence. He asked what happens if AI reduces software bugs so drastically that law enforcement can no longer hack criminals legally.
He voiced concern that AI will make software excessively secure. He warned that the U.S. government might lose access to exploitation vectors. Companies will automatically patch a massive volume of security flaws.
Law enforcement agencies previously claimed encryption prevented them from catching criminals. The term “going dark” gained popularity around 2014. Former FBI director James Comey warned that encryption would block authorities from intercepting communications or reading device data.
During that period, platforms like Signal, WhatsApp, and Apple’s iMessage introduced default end-to-end encryption. Traditional wiretapping became nearly impossible. Tech firms encrypted device storage by default. Breaking into phones protected by passcodes became significantly harder.
Authorities still managed to apprehend suspects by exploiting hardware and software vulnerabilities. Innocent citizens maintained reasonable privacy protections. Green described this setup as an uneasy truce. Governments chose to purchase commercial spyware and hacking exploits rather than forcing companies to build system backdoors.
Green believes AI will disrupt this equilibrium. Language models are getting faster at finding security vulnerabilities at scale. Companies will soon write cleaner software that resists external attacks.
He predicts this shift could prompt governments to demand built-in backdoors. That outcome would weaken security for all users by design. Industry feedback on Green’s theory remains divided across experts, researchers, and government exploit developers.
Luna Tong, a security researcher with offensive security experience, agreed with the assessment. She stated that the current abundance of discoverable bugs is a brief phenomenon. Vulnerabilities will become scarce again soon.
An anonymous security veteran expressed concern that AI will make human researchers obsolete. AI defenders will gain an edge because finding manual bugs will prove too difficult.
Paolo Stagno, CTO at vulnerability firm Crowdfense, stated that state agencies will never abandon surveillance capabilities. He noted that exploiting zero-day flaws is currently the most balanced surveillance method, but that model could collapse if vulnerabilities disappear.
Four offensive cybersecurity specialists disagreed with Green’s conclusions. They argue that AI will clear out simple bugs while complex vulnerabilities persist. They added that AI tools will assist exploit developers just as much as software defenders.
Hamid Kashfi, founder of DarkCell and researcher at Xbow, noted that unreported bugs far outnumber reported ones. Independent researchers will continue discovering high-value, complex vulnerabilities.
Two zero-day researchers said that hardware mitigation features worry them more than automated AI bug hunting.
Eva Galperin, cybersecurity director at the Electronic Frontier Foundation, believes offensive researchers hold the advantage right now. She cited AI’s scanning power and the influx of buggy code generated by AI coding tools.
Galperin added that discovering bugs does not guarantee swift patching. System updates remain complex. She anticipates authoritarian governments will push for backdoors regardless of bug counts.
Katie Moussouris, founder of Luta Security, noted that fully bug-free devices remain a distant reality. She expects finding exploits will eventually grow harder, which could trigger renewed calls for government backdoors. However, she estimates intelligence agencies will not face severe operational limits from AI security for several years.
