The Two Groups Who Cannot Both Be Right
On one side: top-tier Google engineers, cybersecurity researchers at major firms, people running security for the largest banks. All saying versions of the same thing. AI-powered vulnerability discovery is real. The surge in exploits is coming. Pay attention now, before it arrives.
On the other side: the mythos hype index. A dataset-driven counter-argument. 94 out of 100 points toward hype. The predicted surge in AI-powered attacks is not happening yet. The claims are marketing dressed as security research.
Both groups are credible. Both cannot be right. Here is what the data actually shows.
The Firefox Number
Anthropic partnered with Mozilla , the organization behind Firefox , to test AI-assisted vulnerability discovery on the Firefox codebase.
In one month, they found 7 times more vulnerabilities than had been found in the same codebase through traditional methods over a comparable period.
Seven times. One month. One codebase.
This is not a theoretical result. Firefox is one of the most audited, most security-researched codebases in open source software. It has been reviewed by thousands of skilled security researchers for over two decades. The idea that AI could find 7x more vulnerabilities in it, in a month, is either a landmark result or a result that needs careful scrutiny of the methodology.
The same week, Apple and Google's security teams published findings pointing in the same direction: AI-assisted fuzzing and code analysis is surfacing vulnerability classes that traditional methods consistently missed.
What the Hype Index Gets Right
The mythos hype index makes a fair point: there has been a large volume of AI security content that is more marketing than signal. Security vendors have strong incentives to amplify AI threat narratives , it sells products. The language of "bug apocalypse" and "exploit surge" is useful for generating attention, less useful for generating accuracy.
The real-world evidence of large-scale AI-powered attacks at the level being predicted , as of the data the index covers , is limited. The most credible AI-assisted attacks documented so far are targeted, sophisticated, and not yet operating at the automated mass scale that the scariest predictions describe.
Both things can be true at once: the capability is real, the current deployment of that capability is limited, and the gap between the two is closing.
The Calm Before the Storm Argument
The cybersecurity experts who are most alarmed are not alarmed because the attacks are happening now at scale. They are alarmed because the capability exists, the tools are getting cheaper and more accessible, and the lag between capability and deployment tends to be shorter than people expect.
AI-powered vulnerability discovery is already being used by legitimate security teams. The same tools will be used by the people on the other side. The question is not whether this happens , it is how much lead time defenders have to prepare before it does.
The practical advice is the same regardless of which camp turns out to be right: update everything now. Use a password manager. Review what would happen if your most sensitive account was compromised tomorrow. The cost of these precautions is low. The cost of not having taken them, if the 7x number proves to be a preview of what's coming broadly, is high.
If it turns out to be pure hype: you are simply more secure than you were. If it turns out to be accurate: you had warning. Either way, this is a good time to take it seriously.