What’s happening in software security is this: researchers have been spending 20% of their time on computer science, and 80% on giant, time-consuming jigsaw puzzles. And now everybody has a universal jigsaw solver.

In a post-attention-scarcity world, successful exploit developers won’t carefully pick where to aim. They’ll just aim at everything. Operating systems. Databases. Routers. Printers. The inexplicably networked components of my dishwasher. These kinds of targets run everywhere, including in every regional bank and hospital chain in North America. To patch them, someone has to get in a car, drive somewhere inconvenient, and push a physical button.

These weak points were priced into everyone’s cost of doing business. If a criminal exploits one, they win a ransomware heist. But lucrative as ransomware is, it’s not the jackpot earned from a reliable Chrome drive-by. So elite talent doesn’t bother. That load-bearing bit of risk analysis is built into every IT shop in North America. It no longer holds.

This weekend a Kimi 3T model went online, with plans to open the weights next week. They deliberately hobbled its hacking capabilities by filtering the training data... which brought it down from 90% success to 80%.

Earlier this year I've argued about the philosophy of intelligence by saying LLMs are "as smart as a script kiddie." That's not as illustrative when they can pull off a Stuxnet attack on-the-fly. It's certainly a lot less funny.