AI is now finding bugs no human would have found
Issue #056 · 4 min read
AI is now finding bugs no human would have found
A mathematician's approach to hacking, a secrets scanner built for agents, and a changelog flooded by one vendor
The big story
Security researchers have a new worry, and it isn't the usual ransomware crew.
It's called Mythos, and it uses mathematical reasoning to find software bugs that human researchers were missing entirely.
This is now a second exploited bug that no human found first — that's The Register, covering this week's episode of The Kettle.
The framing is blunt: human hacking crews like Shiny Hunters might become obsolete, not because AI writes better phishing emails, but because it can out-math them.
That's a different kind of threat than the usual "AI helps attackers write code faster" story. A system approaching vulnerability discovery mathematically doesn't get tired, doesn't need to learn the codebase first, and doesn't stop at the first bug it finds.
For product people, the read is not "panic." It's "your security team's backlog assumptions just changed." If bug discovery is about to get a lot cheaper for one side only, patch velocity stops being a nice-to-have and becomes the whole game.
What shipped
GitHub shipped a purpose-built model that catches leaked secrets with more context, aimed specifically at the mess AI agents create. The changelog frames it as keeping secret protection in step with "the way you build software, whether you write code yourself or work with an AI agent."
Translate that: agents commit things humans wouldn't, and the old secret scanners weren't built with that pattern in mind.
If your team has agents opening PRs unsupervised, this is worth a look before the next incident review.
GitLab now gives security teams one dashboard for risk across every group they run, instead of a spreadsheet rebuilt by hand each time someone asks. The post is candid about the problem it's replacing: "operational work rebuilt in spreadsheets and one-off scripts every time someone asks," data that's "out of date the moment it is published."
That's a familiar failure mode for any PM who has had to answer "what's our org-wide exposure" with three tabs open and no good answer.
Linear added stacked pull requests to Linear Diffs — you can now move through a stack and see review, CI, and merge status together, with related PRs grouped into one collapsible row, per the changelog. Small, but it's the kind of friction removal that compounds across a team shipping in small chunks daily.
One honesty note on today's haul: GitHub and Vercel together account for well over half of the product items in the queue — Copilot JetBrains controls, Copilot code review billing, draft PR limits, CodeQL updates, plus a run of eight separate "model now on AI Gateway" entries from Vercel. That's release-notes volume, not news. We picked the three above because a PM can actually act on them this week; the rest is plumbing.
What I'd actually do this week
- If your repo accepts AI-generated PRs from outside contributors or agents, check whether your secret scanning was built with agent behavior in mind — GitHub's new model suggests the old ones weren't.
- If you run security across multiple teams or business units, ask whoever owns that spreadsheet how old the numbers in it actually are. GitLab's dashboard pitch is basically describing your current process back to you.
- Read the Mythos item above with your head of security, not just for interest — ask them plainly whether your current bug bounty or pen-test cadence assumes a slower attacker than the one now showing up.
Reply if you've run into an agent-committed secret the old scanners missed — curious how common this already is.