AI Could Make Government Hacking Tools Harder to Use

Artificial intelligence could create an unexpected problem for governments that rely on hacking tools to investigate criminals: there may eventually be far fewer software vulnerabilities left to exploit.

That is the concern raised by cryptography professor Matthew Green, whose recent comments sparked a major discussion across the cybersecurity community. In a viral thread on X and a longer blog post earlier in August, Green explored what could happen if AI becomes so effective at finding software bugs that developers are able to fix vulnerabilities faster than governments can use them.

“I’m concerned that AI is going to make software much too secure,” Green wrote. He warned that the U.S. government could eventually lose access to the security flaws it uses to conduct lawful surveillance as companies begin identifying and patching bugs at an unprecedented scale.

The issue is closely connected to a long-running debate over encryption.

For years, law enforcement agencies have argued that stronger encryption makes it harder to investigate criminals and terrorists. The phrase “going dark” became widely associated with this debate in 2014, when then-FBI Director James Comey warned that encryption could prevent authorities from accessing communications and information stored on devices.

Since then, end-to-end encryption has become common across services such as Signal, WhatsApp and Apple’s iMessage. Apple and other technology companies have also increasingly encrypted data stored on devices by default. Strong PINs and passphrases can make those devices extremely difficult to access through traditional methods.

Yet governments have continued to gain access to targeted devices in some cases.

One reason, Green argues, is an informal compromise that has developed over the years. Instead of forcing technology companies to install backdoors into their products, governments have spent money acquiring hacking tools and spyware capable of bypassing existing security protections.

That balance could change if AI dramatically improves software security.

A temporary “gold rush” of vulnerabilities?

Large language models are becoming increasingly capable of identifying security vulnerabilities at scale. If that trend continues, developers could potentially discover and fix bugs much faster, leaving fewer weaknesses available for offensive researchers and government agencies to exploit.

Luna Tong, a researcher who previously worked at two major companies involved in finding bugs and developing exploits for governments, agrees with Green’s basic argument. Tong described the current market as a “gold rush of bugs,” but believes it could be temporary as vulnerabilities become harder to find.

Another researcher with more than a decade of experience in offensive security said AI could eventually make human security researchers less important. The researcher, who requested anonymity, also suggested that defenders could ultimately gain an advantage over offensive researchers.

However, not everyone in the industry expects governments to lose their ability to hack into targeted systems.

Paolo Stagno, chief technology officer at Crowdfense, a company known for developing, acquiring and selling zero-day vulnerabilities to governments, said governments are unlikely to simply give up surveillance capabilities.

Stagno described the current system — where governments exploit security flaws to access specific targets — as the “most democratic system we have.” But he acknowledged that this approach could come under pressure if vulnerabilities become significantly harder to discover.

Other researchers believe AI could actually strengthen the offensive cybersecurity industry.

Hamid Kashfi, founder of offensive security company DarkCell and an employee at AI cybersecurity startup Xbow, argued that many vulnerabilities discovered by AI may never be publicly reported.

“For every AI found and reported bug out there, there are probably 20 that are not reported,” Kashfi said.

That means researchers who discover vulnerabilities may still be able to keep valuable bugs private rather than sending them to software vendors for fixes.

Two researchers currently earning a living by finding vulnerabilities for zero-day companies also said they were less worried about AI than about modern security protections. New defenses built into phones, computers and other devices are already making systems increasingly difficult to compromise.

AI could help both attackers and defenders

Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation and an expert on government spyware, sees a more complicated picture.

She said offensive researchers currently have an advantage partly because AI is becoming highly capable of finding bugs. At the same time, the growing use of AI-assisted “vibe coding” may be introducing additional vulnerabilities into software.

But discovering vulnerabilities does not automatically mean those bugs will be fixed quickly.

Galperin pointed out that patching software can be complicated, meaning some vulnerabilities could remain exposed even after they are identified. She also believes governments will eventually renew efforts to obtain backdoors because authoritarian governments will continue seeking what she called “exceptional access.”

Katie Moussouris, founder and CEO of Luta Security, has spent decades helping companies identify and patch vulnerabilities. She believes there is still a long way to go before modern phones and laptops become largely free of bugs.

“There will be some point at which finding bugs will be much harder and that may trigger these pressures to build in backdoors,” Moussouris said.

For now, however, she does not expect the shift to happen immediately.

“I think we have at least until after the next presidential election before the intelligence community is materially hampered enough to push for backdoors in a serious way,” she said.

The debate highlights a larger question about AI and cybersecurity. If AI makes software dramatically safer, that could be good news for ordinary users — but it could also force governments to reconsider how they conduct digital surveillance. The alternative, critics fear, could be renewed pressure to build intentional weaknesses into the technology everyone uses.

Also read : Apple TV Raises Subscription Prices Again