AI Will Make Software Too Secure — and the Intelligence Agencies Will “Go Blind”

Matthew Green, a cryptographer at Johns Hopkins University, has framed a paradoxical fear: artificial intelligence is about to make software too secure. On its own that sounds like good news, but it has an unpleasant flip side.

How law enforcement learned to break in

Green recalls the recent history. In the late 2000s smartphones appeared that didn't just transmit data but stored it too. Around 2010 Apple began encrypting the contents of the iPhone with a key derived from the passcode, and Android soon followed. By 2016 nearly a billion WhatsApp users were communicating through end-to-end encryption by default.

The FBI responded with the Going Dark initiative (2014) and demands for “exceptional access.” It all culminated in the Apple v. FBI case of 2016: the bureau demanded that a shooter's iPhone be unlocked, Apple refused — and the deadlock was unexpectedly broken by a third-party company that simply hacked the phone. Since then the dispute has lost its edge: the agencies gained access to commercial tools such as GrayKey for unlocking and Pegasus from NSO Group for remote exploitation. Vendors patched the holes, but the vulnerability hunters reliably kept the upper hand.

The era of AI bug hunting

Everything changed, Green argues, with the arrival of models tuned for finding vulnerabilities. In April 2026 Anthropic released Mythos, a model optimized for that task; the U.S. government temporarily restricted its export. The measure proved pointless: OpenAI and the Chinese open-model labs — Z.ai and Moonshot — showed that no one would hold a monopoly on such hunting.

Now defenders are patching vulnerabilities en masse — ones accumulated over decades. Entire build pipelines are being reworked so that AI scanners check the code before a hacker ever gets to it. Finding absolutely every bug is impossible, but Green expects that within the next couple of years large, well-maintained programs will simply exhaust their supply of remotely exploitable holes.

The downside of security

For intelligence and police work this means a true “going dark” — for the first time since 2010. And that means demand for built-in, deliberate backdoors will return with renewed force, and pressure will mount on the industry to redesign systems for “exceptional access.”

The most dangerous part, Green stresses, is that such backdoors will weaken above all the very countries that demand them. The United States risks weakening its own systems at the exact moment it has finally begun putting its infrastructure in order — while foreign governments may abandon American software altogether.

The author has no ready-made recipe. This, he admits, is not a call to action but merely a recognition that we are being carried toward a world that will differ noticeably from today's. One can only hope that this time the choice turns out to be the right one — if only because it is the right one.

Source: Hacker News