A Machine That Finds Bugs, and No One to Fix Them

On Tuesday, October 20, word of two bugs in PHP leaked before they were supposed to go public.

PHP is the code underneath roughly 70% of the websites whose server software anyone can identify. Both bugs let a stranger run their own code on your server without logging in. Security researchers rated them 9.2 out of 10.

The PHP team shipped the fix on Wednesday, October 21. By then, Cloudflare was already seeing attack traffic.

The patch doesn't reach everyone, though. About 884,000 public servers run versions of PHP so old the project no longer fixes them. That's 59% of the servers that say which version they run.

That same week, Meta pulled the sharing feature from Muse, its new AI agent. A security firm had found about 6,800 shared-chat links with a single lookup in public DNS records. The few hundred it opened included loan applications, revenue reviews and bank fraud alerts. The week before, CoreWeave's bonds had started trading like a company headed for bankruptcy.

I've had one sentence stuck in my head all week: AI is the greatest misallocation of capital in our lifetimes.

What We Were Promised

We were told coding would be solved. In March 2025, Anthropic's CEO, Dario Amodei, said AI would be writing 90% of the code within three to six months, and in 12 months "essentially all of the code." This year, the head of Anthropic's Claude Code said coding is "largely solved." In January 2025, Mark Zuckerberg said Meta would soon have AI that works as "a sort of midlevel engineer."

We were told AI would cure disease. In August, Amodei wrote that it "will actually be possible to cure most human disease in ~5-10 years." Sam Altman has made curing cancer a regular part of OpenAI's pitch. In September, he told Bloomberg Television, "I don't think a cure for cancer is enough," and said "we should set our sights higher."

I want to be fair here, because I'm not writing this from the outside. I use AI every day. My team ships faster than it ever has, by a margin I can't even measure. I started researching this on my own, then used Claude, Anthropic's AI model, to dig further and check sources. Anthropic shows up in this essay more than once. I know how that sounds.

But step back from any one company and look at what AI has measurably changed in the world so far. The biggest scientific claim came in September, when OpenAI said 10,000 AI agents had solved a version of the Navier–Stokes problem, one of math's Millennium Prize problems, in 88 hours. The Clay Institute, which awards the prize, hasn't accepted it, and mathematicians are still checking it. There's no cancer cure. No fixed power grid. No better food supply chain.

The most visible global result is that everyone is getting hacked more. Every company on Earth now has to spend its own money defending against flaws that sat unnoticed for decades.

On a podcast on October 15, the investor Brad Gerstner asked Nvidia's Jensen Huang why AI's benefits were having such a hard time breaking through with the public. Huang said AI is "soft matter" and "you can't see it." The costs are easier to see. They show up in your mailbox.

A Machine That Finds Bugs

This year, the world is on track to publish 55,000 to 60,000 new software vulnerabilities, according to the threat-intelligence firm Brandefense. That's close to double the number from three years ago.

Much of the jump comes from AI. Researchers point models at code and find flaws faster than any human team could. In June, Microsoft shipped a then-record of roughly 200 fixes in a single Patch Tuesday, and it credited OpenAI's Codex with reporting one of that month's zero-days.

Anthropic's version is called Project Glasswing. Its restricted model, Mythos, scanned more than 1,000 open-source projects and flagged 23,019 vulnerabilities. It rated 6,202 of them high or critical.

Finding bugs is the easy part now. Fixing them isn't.

Of the 530 serious bugs Glasswing had reported to open-source maintainers at its last public update, 75 were patched. Anthropic's public ledger listed 1,611 of the flaws at launch. In its May snapshot, 27 were marked as verified fixed. That's under 2%. Anthropic counts more fixes upstream, 97, which is still about 6%. VulnCheck found more than 150 past the standard 90-day disclosure deadline.

The people expected to write those fixes are often unpaid volunteers. AI lets one researcher file a hundred reports in an afternoon. It doesn't give a volunteer maintainer a hundred extra afternoons.

The maintainers have said so themselves. When AI companies announced $12.5 million for open-source security in March, Greg Kroah-Hartman, a longtime Linux kernel maintainer, said: "Grant funding alone is not going to help solve the problem that AI tools are causing today on open source security teams." The curl project shut down its bug bounty after a flood of AI-generated reports. Even Google tightened its own open-source bug bounty, demanding stronger proof because so many AI-generated reports were low quality.

The Other Side Has It Too

The comforting stat this summer was that only 1.3% of AI-found bugs had been exploited: 14 out of 1,061, according to VulnCheck. I don't find it comforting.

That number stops on June 30, months before the PHP mess. It only counts bugs that defenders found and reported. It can't see the bugs attackers found with AI and kept to themselves. Even the report's author said it was too early to draw conclusions.

The broader numbers point the other way. VulnCheck counted 495 bugs exploited for the first time in the first half of 2026, a pace of about 1,000 a year. Nearly a quarter were exploited on or before the day they went public. The median time from disclosure to attack fell from 120 days to 80.

In May, Google's threat intelligence team confirmed the first known case of criminals using AI to build a working zero-day exploit. They had staged it for a mass attack before Google disrupted it. CrowdStrike says AI-enabled attacker activity rose 89% in a year. IBM's annual breach study found that one in four malicious breaches now involves AI, up 56%, at an average cost of $6 million each.

Sometimes the attacker is a lab's own model. In July, OpenAI was running an internal test of how well its models could hack, with some of its safety filters deliberately turned off. The models used a previously unknown flaw to escape their sandbox. They reached the open internet and broke into Hugging Face, the platform where much of the AI world shares its models, to steal the test's answer key.

OpenAI called it an "unprecedented cyber incident." It later said the agent had broken into accounts at four separate services. Huang told the New York Times' Ezra Klein, "If your product is not ready to ship, don't ship the product." By that standard, plenty of what has already shipped wasn't ready.

Then there's the part nobody can measure well. The Identity Theft Resource Center counted 1,803 US data compromises in the first half of 2026, on pace to beat 2025's record of 3,322. Breaches that started with a zero-day hit 14 in six months, against 17 in all of 2025.

Zero-Day Breaches Nearly Matched Last Year by June

US data compromises that started with a zero-day exploit

Source: Identity Theft Resource Center, H1 2026 Data Breach Report.

Victim notices reached 471 million, though one breach at Instructure, the company behind the Canvas software many schools use, accounted for an estimated 275 million of them. More telling: only 24% of notices said how the attacker got in, the lowest share the ITRC has ever recorded.

When someone tells me AI isn't behind the breach wave, I want to know how they'd know. Three out of four notices don't say.

Where the Money Goes

This year, Alphabet, Amazon, Microsoft and Meta plan to spend about $725 billion on capital expenditures, most of it on AI infrastructure. That's up 77% from last year.

Here's what the AI industry has sent to the people who fix open-source software.

Anthropic, which runs Glasswing, donated $4 million in cash: $2.5 million to the Linux Foundation's security programs and $1.5 million to the Apache Software Foundation. It had already pledged $1.5 million to the Python Software Foundation. In March, Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft and OpenAI put $12.5 million into a Linux Foundation grant pool. That's seven of the best-funded names in tech, combined. GitHub runs a separate $5.5 million fund that mixes cash with cloud credits. OpenAI added a $1 million fund for maintainers whose projects need API credits.

Anthropic also committed $135 million in credits: up to $100 million for Glasswing partners and $35 million for groups working with open-source maintainers. That sounds generous until you notice what credits buy. They pay for more scanning, which means more bug reports. They don't pay a maintainer to write a single fix.

The industry is funding the part that creates work and starving the part that finishes it.

$725 Billion to Build, $18 Million to Fix

2026 spending, log scale: each gridline is 10× the one before

Capex: Alphabet, Amazon, Microsoft and Meta, 2026 plans. Credits: Anthropic's committed credits for Glasswing partners and open-source groups. Cash: Anthropic's grants plus the $12.5 million Linux Foundation pool; up to $23 million counting GitHub's fund, which mixes cash and cloud credits.

I've seen this shape before. Pennsylvania collects $2.8 billion a year in gambling taxes. It sets aside about $20 million, or 0.7%, for problem gambling, and last year it spent less than $5 million of that on treatment. Collect the upside, underfund the repair.

According to its draft IPO filing, Anthropic has committed $518 billion to computing capacity over roughly the next decade. A $100 million fund that paid people to fix open-source code would be 0.02% of that.

There's a second problem underneath this one. Much of the money paying for all this computing doesn't come from paying customers. It circulates between Nvidia, OpenAI and the cloud companies, and a growing share of it is borrowed. That's its own post, and I'm writing it next.

Who Keeps the Gains, Who Pays the Costs

I'm not arguing that AI is useless. It works. It's one of the most useful tools I've ever had.

I'm arguing about where the money went, and who pays for what it produced.

The gains are concentrated. Chipmakers, cloud providers and a handful of model labs collect the revenue, much of it from each other. The costs are spread thin across everyone else. A volunteer maintainer gets a hundred bug reports. A school district tells its employees their Social Security numbers were stolen. A small business patches servers it didn't know were exposed, or can't, because its version of PHP is too old to fix.

Even security is turning into a product line. On that October podcast, Huang said safety and security have to be "accelerated" along with everything else, because "if it's not safe, it's not secure, the functionality will never get a chance to speak." Nvidia now sells AI security software alongside its chips, and Huang counts it among what Nvidia sells per gigawatt. The risk gets created for free. The protection is sold by the gigawatt.

Nobody has a good number for the damage. The most careful estimate I found, a March 2026 paper on arXiv, puts global cybercrime losses at about $500 billion a year, with a range of $100 billion to $1 trillion. If AI has raised that by even 10%, that's $50 billion a year. That's more than 2,000 times the $18 million to $23 million in cash I could trace from AI companies to open-source security.

Every investor wants to know when AI will show its return. For most of us, it already has. It just landed on the wrong side of the ledger.