The Vulnerability Explosion Memo

October 31, 2025•Anytool Team

When I was exploring what I wanted to work on next, I wrote this memo on the vulnerability explosion to formalize some of my thoughts on the problem space, how I expected the market to evolve, and the opportunities I saw. Between writing and releasing it, there have been many market developments, but none of this writing has changed.

Preface

Today, agents can negotiate trucking loads, hire contractors, manage procurement and sales, but the second security needs validation, the workflow breaks.

A human has to step in to audit the code.

That's a temporary state of the world. Within the next decade, I believe autonomous security validation will analyze more code than any other category, period. The rails to make that happen though don't yet exist. We're building them.

Specifically, we're creating the intelligence layer that lets AI agents continuously validate security across any codebase, any infrastructure, any deployment pipeline, starting with APIs. Over time, we're consolidating the fragmented security workflows owned by legacy tools and manual processes, making them machine-accessible from the ground up.

Entire industries are missing billions in value because they can't close the loop on security. Think logistics agents that can't validate API endpoints automatically, property management agents that can't verify authentication flows in real time, or procurement agents that can't check for vulnerabilities without human intervention.

We're giving them the protocol to do it, and once these rails exist, every development workflow instantly becomes end-to-end secure.

This is a once-in-a-generation moment. Security validation has been effectively static for decades, and now it's about to be rebuilt, not for humans, but for machines.

Intro

Every line of code is a potential attack vector. In 2025, as AI generates billions of lines daily, the surface area for exploitation grows exponentially faster than our ability to secure it.

We are witnessing a fundamental shift in how software is created. GitHub Copilot writes 46% of code across all languages. ChatGPT generates complete applications from prompts. Claude builds entire systems in minutes. The velocity of software creation has accelerated beyond human comprehension, but the security practices have not kept pace.

AI-generated code inherits patterns from its training data: outdated libraries, deprecated authentication methods, SQL injection vulnerabilities disguised in modern syntax. These models optimize for functionality, not security. They learn from Stack Overflow answers written in 2015, from open-source repositories riddled with CVEs, from codebases that prioritized shipping over hardening.

The result is an explosion of sophisticated vulnerabilities hidden beneath clean, working code. A surface-level code review reveals nothing. Static analysis tools miss context. Traditional security audits cannot scale to match the pace of AI-driven development. The attack surface has grown infinite while our defenses remain finite.

What happens when the tools building our infrastructure are fundamentally insecure by design? When every API endpoint, every authentication flow, every data pipeline carries inherited vulnerabilities from training data that predates modern security standards?

The companies that solve this problem will own the future of software security. The question is not whether AI-generated code is vulnerable. The question is who will build the intelligence layer that can find and fix these vulnerabilities at the speed they are created.

Background

For simplicity's sake, we're going to consolidate everything down into two security testing categories that are going to exist: black box and white box. Each reveals different truths. Each requires different intelligence. Together, they form complete coverage.

Black Box Testing

This is the attacker's view. No source code, no architecture diagrams, no insider knowledge. Just a target and the will to compromise it.

Black box testing mirrors real-world attacks. Attackers do not request your codebase. They probe your APIs, fuzz your inputs, chain unexpected behaviors until something breaks. They find the paths developers never imagined because developers think in features, not exploits.

The challenge is scale. Traditional black box testing is labor-intensive. Security researchers manually craft payloads, observe responses, and iterate. A thorough test of a single endpoint might take hours. A complete application might take weeks. An entire infrastructure might take months.

White Box Testing

This is the insider's view. Complete access to source code, configuration files, infrastructure diagrams. The ability to trace every execution path and analyze every decision point.

White box testing finds vulnerabilities that black box testing cannot. Logic flaws in authentication flows. Race conditions in concurrent operations. Cryptographic mistakes hidden in implementation details. These issues are invisible from outside but catastrophic when exploited.

The problem is context. A human auditor might review 500 lines of code per hour. A large application contains millions. The math does not work. Even the most thorough audit misses things simply because human attention is finite.

The problems

Now that there's some alignment on the categorical buckets of security testing, let's examine the problems that are created in this future:

Traditional rails become costly and too slow

Traditional security validation (penetration testing, code audits, compliance checks) is designed for transactions at the frequency and speed at which humans operate. Using a quarterly penetration test to validate security might involve weeks of manual work, days of reporting, and a non-trivial amount of risk that vulnerabilities are missed between tests.

Today, if you're hiring a human today to audit your codebase, there may be a back and forth conversation that happens over multiple emails over the course of weeks. Further, the delivery of the audit may take days or weeks. The human-to-human interaction is slow.

When much of the code that would have historically been written by humans is now generated by AI, and the time to deployment is shrunk down from weeks to seconds or minutes, it's imperative that the security validation that mediates these interactions is real-time.

Imagine a world where you task a general purpose agent to do something as ambiguous as "build this API". In this world, there are sub-agents that are far better at each part of this request: authentication, authorization, data validation, etc. This is already happening with multi-agent architecture. In this construct, the master agent becomes a router for a bunch of sub-requests that may end up getting owned by different agents, and therefore, different companies.

This poses a new challenge, how do agents validate security across these distributed systems? The agent needs access to a set of tools that it can call to verify the security posture of every component, test every integration point, and log the validation in a centralized place for auditing and compliance purposes.

Further, if the agent submits a request to a specific authentication-focused agent, and the total latency of that request is going to be less than 5 minutes, then you can imagine a world in which the security validation of that component needs to be verifiable in nearly real-time as the agent is going to return work that it wants to be deployed. The existing security infrastructure doesn't support any of these problems.

The breaking point

Software security has always been reactive. We build, we ship, we patch. The cycle repeats endlessly, each iteration costing more than the last.

In 2024, the average data breach cost $4.45 million. By 2025, this number has grown as AI accelerates both development velocity and attack sophistication. Companies ship faster than ever, but they are also compromised faster than ever. The economics are unsustainable.

Traditional penetration testing is a quarterly event. Security teams manually probe systems, document findings, and send reports that developers may or may not address before the next sprint. By the time the report arrives, the codebase has evolved. New features mean new vulnerabilities. The cycle never closes.

Meanwhile, attackers have automated everything. Botnets scan millions of endpoints per second. Exploit frameworks chain vulnerabilities automatically. Ransomware groups operate like Fortune 500 companies with customer service and profit-sharing models. The asymmetry is staggering: defenders work in quarterly cycles while attackers operate in milliseconds.

The gap widens daily. Every new AI-generated microservice, every auto-deployed container, every dynamically scaled endpoint represents potential compromise. The traditional model of "test before production" has collapsed under the weight of continuous deployment and AI-assisted development.

What we need is not more pentesting. We need continuous, autonomous security validation that operates at the same velocity as modern development. We need AI agents that think like attackers, operate like defenders, and scale infinitely.

The Dual Approach

Security testing exists on a spectrum between two extremes: black box and white box. Each reveals different truths. Each requires different intelligence. Together, they form complete coverage.

Black Box Testing

This is the attacker's view. No source code, no architecture diagrams, no insider knowledge. Just a target and the will to compromise it.

The challenge is scale. Traditional black box testing is labor-intensive. Security researchers manually craft payloads, observe responses, iterate. A thorough test of a single endpoint might take hours. A complete application might take weeks. An entire infrastructure might take months.

AI changes this completely.

Autonomous agents can execute millions of test cases per hour. They learn which injection patterns work against which frameworks. They recognize when a 500 error reveals stack traces that expose internal architecture. They chain API calls in sequences humans would never consider, finding logical flaws that bypass every input validation.

The agents operate continuously. Every code deployment triggers a new testing cycle. Every API change spawns thousands of attack simulations. The system builds an evolving map of your attack surface, identifying new vulnerabilities the moment they are introduced.

This is not static analysis. This is adversarial intelligence that adapts to your defenses and finds ways through them.

White Box Testing

This is the insider's view. Complete access to source code, configuration files, infrastructure diagrams. The ability to trace every execution path and analyze every decision point.

These issues are invisible from outside but catastrophic when exploited.

AI agents do not tire. They do not lose focus. They analyze every function, every variable, every potential execution path simultaneously.

The agents understand code at multiple levels. They recognize when a library version contains known CVEs. They detect when authentication logic can be bypassed through parameter manipulation. They identify when error handling leaks sensitive information. They spot when database queries are vulnerable to injection despite using prepared statements incorrectly.

More importantly, they learn from every codebase they analyze. Patterns that appear safe in isolation become suspicious when seen across thousands of repositories. The agents build an intuition about what vulnerable code looks like, even when the vulnerability is novel.

The Convergence

The magic happens when black box and white box testing inform each other. This creates a feedback loop that compounds in power.

Consider this scenario: The black box agent discovers an API endpoint that accepts JSON payloads. It fuzzes the input and notices that certain malformed JSON causes slower response times. Suspicious, but not definitive.

The black box agent communicates this finding to the white box agent, which examines the source code for that endpoint. It discovers that the JSON parsing library has quadratic worst-case performance. The specific malformed input triggers this worst case. The white box agent calculates that a coordinated attack could cause complete denial of service.

The white box agent reports this finding back to the black box agent, which now crafts an optimized exploit proving the vulnerability is exploitable in production. The system automatically generates a detailed report with proof of concept, affected code paths, and recommended remediation.

This entire sequence happens in seconds. The feedback loop between external probing and internal analysis creates compound intelligence that exceeds what either approach achieves alone.

The agents develop something approaching intuition. The black box agent learns which observable behaviors correlate with internal vulnerabilities. The white box agent learns which code patterns are most likely to be exploitable in practice. Together, they predict where vulnerabilities will emerge before they are exploited.

Continuous Validation

Security is not a point-in-time assessment. It is a continuous process that must operate at the same velocity as development.

Every git commit triggers analysis. Every deployment initiates testing. Every configuration change spawns validation. The system operates as a continuous integration pipeline for security, running parallel to development without blocking it.

The agents maintain a living threat model of your entire infrastructure. They know which services communicate, which databases store sensitive data, which APIs are publicly exposed. When a new vulnerability is discovered in a third-party library, they immediately assess impact across your entire codebase and prioritize remediation by exploitability.

The core metric is time to detection. Traditional security testing might find a critical vulnerability weeks after introduction. Our agents find it within minutes of the commit that introduced it. The difference between minutes and weeks is the difference between a non-event and a headline.

The system learns from every test cycle. Initial scans might generate false positives. Developers mark findings as intended behavior. The agents learn to distinguish between security issues and acceptable risk decisions. The noise decreases while detection accuracy increases.

Over time, the agents develop deep knowledge of your specific environment. They understand your architectural patterns, your coding standards, your risk tolerance. They become calibrated to your context, finding real issues while filtering out irrelevant theoretical vulnerabilities.

The Implementation

Building this requires solving problems that traditional security tools ignore.

Orchestration Layer

The system needs to coordinate hundreds of specialized agents, each focused on specific vulnerability classes. SQL injection agents, authentication bypass agents, privilege escalation agents, each operating autonomously but sharing findings through a central intelligence layer.

This orchestration happens at multiple levels. High-level agents decide which areas need deeper investigation. Mid-level agents coordinate between black box and white box testing. Low-level agents execute specific attack patterns and analyze specific code sections.

The hierarchy allows for both breadth and depth. Broad scans identify potential issues across the entire attack surface. Deep dives exhaustively test specific areas. The system balances coverage with thoroughness, ensuring nothing is missed while avoiding redundant work.

Exploit Generation

Finding a vulnerability is valuable. Proving it is exploitable is essential. The agents do not just identify potential issues. They craft working exploits that demonstrate real-world impact.

This serves two purposes. First, it eliminates false positives. A theoretical vulnerability that cannot be exploited in practice is not worth fixing. Second, it provides clear reproduction steps for developers, eliminating ambiguity about severity and remediation priority.

The exploit generation is contextual. The agents understand your environment and craft exploits that work specifically against your configuration. They chain multiple low-severity issues into high-severity exploits, revealing risks that simple vulnerability scanners miss.

Remediation Guidance

The agents do not just find problems. They fix them.

For each vulnerability, the system generates specific remediation guidance. Not generic advice like "sanitize inputs" but concrete code changes: "Replace line 47 with this specific implementation that properly escapes user input before database insertion."

For complex issues, the agents propose multiple remediation strategies with tradeoffs. They might suggest an immediate patch that reduces risk along with a long-term refactoring that eliminates the vulnerability class entirely.

The goal is to make fixing vulnerabilities as easy as introducing them. When the barrier to remediation is low, developers actually fix things. When it requires deep security expertise, fixes are delayed or incorrect.

Priority Intelligence

Not all vulnerabilities are equal. A theoretical SQL injection in an internal admin panel used by three people is different from an authentication bypass in your public API.

The agents understand context. They know which endpoints handle sensitive data. They know which services are internet-exposed. They know which systems are critical to business operations. This context informs severity scoring beyond simple CVSS ratings.

The system also considers exploitability. A vulnerability that requires physical access to your data center is less urgent than one exploitable remotely. A flaw that requires authentication is less critical than one that bypasses all access controls.

Priority is dynamic. As the threat landscape evolves, the agents reprioritize automatically. When a new exploit technique emerges, they reassess which of your vulnerabilities are now exploitable through this new method.

The Defensive Moat

Speed as Advantage

Security is a race. Attackers are constantly developing new techniques. The side that innovates faster wins.

Traditional security companies move slowly. They discover a new vulnerability class, develop detection logic, and release an update. Months pass between discovery and deployment. During this window, attackers exploit the gap.

We move differently. Our agents learn from every engagement. When one client's codebase reveals a new vulnerability pattern, agents testing other clients' code immediately begin looking for similar issues. Learning compounds across every deployment.

The feedback loop is measured in hours, not months. A new exploit technique detected on Monday is being tested against every client by Tuesday. There is no manual update process, no signature database to maintain. Intelligence evolves continuously.

Data Network Effects

Every codebase the agents analyze makes them smarter for the next one.

They learn which frameworks have which vulnerabilities. They learn which coding patterns lead to which exploits. They learn which combinations of technologies create unexpected security gaps. This knowledge accumulates into a vast intelligence network that individual security researchers cannot match.

The more code they analyze, the better they become at predicting where vulnerabilities hide. They develop pattern recognition that approaches intuition, flagging suspicious code that human auditors would miss because it does not match any known vulnerability signature.

This creates a moat that widens over time. Competitors starting from scratch lack the accumulated intelligence. They must learn lessons we already internalized. By the time they catch up to our current capabilities, we have moved further ahead.

Continuous Adaptation

The agents evolve with the threat landscape. When a new attack technique emerges, they incorporate it automatically. When a new framework gains popularity, they learn its quirks. When a new vulnerability class is discovered, they test every client for exposure.

This adaptation is not manual. Security researchers do not need to teach the agents about each new threat. The agents monitor security disclosures, analyze exploit code in the wild, and incorporate new testing strategies autonomously.

The system becomes more valuable over time rather than less. Traditional security tools decay as threats evolve. Our agents evolve faster than threats do.

Trust Through Transparency

Security testing requires deep access. Clients need confidence that their code and systems are analyzed securely.

Everything operates in the client's environment. No code leaves their infrastructure. No credentials are stored externally. The agents run locally, analyzing and testing without exfiltrating sensitive data.

Every finding includes complete provenance. The exact test that discovered it, the reasoning behind severity scoring, the specific code or configuration that created the vulnerability. Developers can validate every claim without taking our word for it.

The system maintains detailed audit logs of all testing activities. Exactly which endpoints were probed, which code sections were analyzed, which exploits were attempted. Full transparency about what the agents do builds trust in what they find.

The Wedge

We start where the pain is most acute: API security.

APIs are the connective tissue of modern software. They expose functionality to partners, power mobile applications, enable integrations. They are also the primary attack vector in 2025.

Every company has APIs. Most have hundreds. These APIs evolve constantly as features and requirements change. Traditional security testing cannot keep pace with API evolution. By the time a manual test completes, the API has changed.

Our agents test APIs continuously. Every deployment triggers validation. Every endpoint is probed for vulnerabilities. Every authentication mechanism is challenged. The testing happens automatically, requiring no manual intervention.

This creates immediate value. Companies know their APIs are secure because they are tested constantly. Developers ship confidently because they receive instant feedback about security implications.

More importantly, API testing generates the richest possible context. Every request and response teaches the agents about your architecture. They learn which services communicate, which databases are accessed, which authentication patterns you use. This context becomes the foundation for expanding into deeper security testing.

Expansion Strategy

The Entry Point

a. Deliver immediate value through continuous API security testing. Become the automatic check that runs on every deployment. Build trust through consistent findings and clear remediation guidance.
Infrastructure Expansion

a. Extend beyond APIs into infrastructure security. Test container configurations, cloud permissions, network segmentation. Validate that your infrastructure implementation matches your security intentions.
Code Level Analysis

a. Move upstream into the codebase itself. Analyze application logic for vulnerabilities that manifest downstream. Catch issues before they reach production rather than after deployment.
Threat Modeling

a. Proactively identify attack paths before they are exploited. Build comprehensive threat models of entire systems, highlighting the most critical paths attackers would take. Prioritize security investments based on likely attack scenarios rather than generic best practices.
Autonomous Response

a. Move from detection to prevention. Automatically deploy patches for certain vulnerability classes. Implement runtime protection that blocks exploits in production while permanent fixes are developed. Shift from reactive security to proactive defense.

The progression is natural. Each phase builds on the previous one, creating compound value while expanding the scope of protection.

Market Timing

This moment is unique. Three forces converge to create unprecedented opportunity.

AI Development Velocity

Code generation is accelerating. GitHub reports that 92% of developers use AI coding tools. The average developer is 50% more productive with AI assistance. This productivity comes at a security cost.

AI models do not understand security contexts. They generate code that works but is not hardened. They chain libraries without checking for CVEs. They implement authentication flows based on deprecated patterns.

The volume of vulnerable code is growing exponentially while security practices remain linear. This gap creates urgency. Companies need automated security validation because manual validation cannot scale.

Compliance Pressure

Regulations are tightening globally. GDPR penalties have reached €1.2 billion for single incidents. The SEC now requires public disclosure of material cybersecurity incidents within four days. The EU AI Act mandates security testing for high-risk AI systems.

Compliance is no longer optional. Companies need continuous security validation to demonstrate due diligence. Our agents provide automated documentation of security testing activities, simplifying compliance reporting.

Economic Incentives

The cost of breaches is rising faster than security budgets. The average breach now costs $4.45 million, but high-profile incidents reach hundreds of millions. Companies are desperate for solutions that scale.

Traditional security staffing is impossible. Demand for security engineers far exceeds supply. Salaries are unsustainable. Companies cannot hire their way to security. They need automated solutions that operate at machine scale with human-level intelligence.

Existing Landscape

Snyk

The leader in developer-first security. Snyk scans code repositories and dependencies for known vulnerabilities. They have strong adoption among developers because they integrate seamlessly into workflows.

However, Snyk is fundamentally a signature-based tool. They detect known vulnerabilities in known libraries. They miss logic flaws, misconfigurations, and novel vulnerability patterns. They cannot test running systems or validate that vulnerabilities are actually exploitable.

Veracode

Enterprise static and dynamic analysis. Veracode offers comprehensive security testing but requires manual setup and interpretation. Tests run on schedules rather than continuously. Results require security expertise to prioritize and remediate.

Their approach is thorough but not autonomous. They augment security teams rather than replacing manual testing. The value scales with human effort rather than independently.

Synack

Crowdsourced penetration testing platform. Synack coordinates human researchers to manually test client systems. They provide real-world attack simulation by actual security professionals.

The limitation is throughput. Human researchers are skilled but finite. Testing happens episodically rather than continuously. Coverage depends on researcher availability and interest. The approach does not scale to match development velocity.

Wiz

Cloud security leader focused on infrastructure misconfigurations. Wiz scans cloud environments for security issues like overly permissive IAM roles or publicly exposed databases.

They excel at infrastructure but do not test application logic. A misconfigured S3 bucket is different from a SQL injection vulnerability. Both matter, but Wiz only addresses one category.

Our Differentiation

We combine the breadth of multiple approaches with the velocity of automation. Black box testing like Synack but continuous and autonomous. White box analysis like Veracode but focused on exploitability rather than theoretical issues. Infrastructure coverage like Wiz but extending into application logic.

Most importantly, our agents learn and improve continuously. Every engagement makes them smarter. Every vulnerability pattern discovered enhances detection across all clients. The value compounds rather than staying static.

Risks

When looking at this market, there are two risks that hold real merit. The first, is that the agent market doesn't mature fast enough, and the second is that the existing solutions are sufficiently good such that a new security infrastructure layer is not needed.

Market maturity

Today, most security-led startups are building their entire workflows internally. Regardless of the number of steps the security validation requires, the relation of workflow requirements to the core business, or the relative value of required steps, the entire security process is largely owned internally.

While this is a fine interim solution, we have to imagine that in the near future there will be a meaningful amount of specialization in the creation of security tools. Meaning, a company may set out to create a security tool that accomplishes a broad task say, "securing a microservices architecture", but within are going to be companies that own each portion of that process (API testing, container scanning, network analysis, etc) in a more effective way than if one company is responsible for a number of highly specialized tasks. This can be understood as security tool interoperability.

The lack of specialization in security workflows and progression in security tool interoperability means that the market for autonomous security validation has also not yet materialized. In a world where there are highly specialized security tools that are owned by different companies, the necessity to coordinate between tools in real-time becomes a P0 technical problem, but until that's the reality of the security landscape autonomous validation is basically non-existent.

Further, today most security products that companies are building stop short before they get to any real exploitation validation. Take many SAST tools as an example who are working on static code analysis. Finding potential vulnerabilities is a core part of their workflow, however, when it comes to validating exploitability they still rely on security researchers to manually verify because there isn't a simple and reliable way for them to introduce automated exploitation into their workflow.

With the rate of development of the AI landscape I find that the real risk in this point is missing the wave of how security automation actually materializes, and not in the market failing to reach maturity.

Existing solutions

The second risk when exploring autonomous security validation is that the existing solutions, most notably Snyk and Veracode, come to solutions that are good enough that people build their workflows around those solutions.

If you look today at Snyk's early agent toolkit, you'll notice that most of the functionality is built around agents interacting with the internal Snyk APIs (scanning repositories, checking dependencies, generating reports) or things that humans would have done on the Snyk dashboard.

While these are helpful features, as Snyk's product is quite large and complex at this point, the main functionality that we're positing will need to exist is focused on the autonomous validation of security through both black box and white box testing.

There is a developer preview of an API that gives agents access to programmatic scanning, and while helpful this dependency scanning use case only represents a fraction of the security validation that will be autonomously driven in the near future.

If you believe that most security validation will eventually shift away from humans and towards autonomous systems then you come to the conclusion that you need to build purposefully around that and that only.

What Could Go Wrong

False Confidence

The danger of automated security is trusting it completely. No system is perfect. Our agents might miss sophisticated vulnerabilities that human experts would catch. Clients might reduce human security efforts because they trust the automation.

We address this through transparency and calibration. The system reports confidence levels for every finding. It highlights areas where additional human review is recommended. It complements rather than replaces human expertise.

Adversarial Adaptation

Attackers will learn how our agents operate and craft exploits designed to evade detection. This is inevitable with any security tool.

The counter is continuous evolution. The agents learn from real-world attacks and update their detection strategies. The feedback loop between threat intelligence and testing methodology keeps pace with adversarial innovation.

Scope Creep Paralysis

The ambition to secure everything might prevent us from securing anything well. Attempting to solve all security problems simultaneously dilutes focus and delays delivery.

The solution is disciplined expansion. We start with APIs because they deliver immediate value and generate rich context. We expand methodically into adjacent areas only after proving value in the current domain. Each phase must be excellent before we progress to the next.

Scale Economics

Running continuous autonomous testing is computationally expensive. As we scale to more clients with larger codebases, infrastructure costs could exceed revenue.

We address this through efficient agent orchestration and smart prioritization. Not every line of code needs deep analysis on every change. The agents learn where vulnerabilities typically hide and focus effort there. Coverage remains comprehensive but resource allocation becomes intelligent.

The Path Forward

Software is eating the world, and AI is accelerating this consumption. Every digital system, every connected device, every automated process represents potential compromise.

The companies that secure this expanding attack surface will capture extraordinary value. Security is not optional. It is existential. Every organization building software needs continuous validation that their code is not catastrophically vulnerable.

We are building the autonomous security layer for the AI era. The agents that find vulnerabilities faster than attackers exploit them. The intelligence that evolves with threats rather than lagging behind them. The platform that makes security scale with development velocity instead of constraining it.

This is not a better penetration testing tool. This is the continuous security validation layer that makes modern software development sustainable. The difference between quarterly reports and continuous validation. The difference between vulnerability detection and exploit prevention.

The invisible agents that secure the code powering everything.