Faster, Not Smarter

David Deutsch, AI and Offensive Security

Every vendor deck I have seen in the last eighteen months makes some version of the same claim: AI has changed the attacker. The adversary is now smarter, more capable, more inventive. The defender is outmatched by a machine that thinks.

I build AI attack tooling for a living. I run a team that tests LLM applications and deploys autonomous exploitation agents against real client environments. And I think the claim is wrong in a specific and consequential way.

AI has not made attackers smarter. It has made them faster. The industry keeps pricing those as the same thing, and that mispricing is now shaping budgets, controls, and policy.

What people actually mean

"Smarter attackers" is rarely defended as a claim. It is asserted, and then supported by pointing at four or five things. It is worth taking each one literally.

Autonomous pentesting An agent enumerates a network, identifies exposed services, tries known techniques against them, and chains what works. Every technique in its repertoire was published by a person. What the agent contributes is that it never gets bored and it runs in parallel. That is throughput.

AI-authored malware The samples that have surfaced are functional, unremarkable, and structurally familiar. They are cheaper to produce than they were, which lowers the barrier for unskilled operators. Cheaper is not smarter.

Polymorphism This one gives the game away. Polymorphic and metamorphic malware are roughly thirty years old. Signature evasion by mutation predates the transformer by decades, and if the mechanism is the argument, the argument was already available in 1995.

Spear phishing at scale The most substantive of the four, and I deal with it properly further down, because it is the one where I have to give ground.

Notice what these have in common. In every case the technique existed, the operator's cost fell, and the volume went up. The repertoire did not expand. What expanded was the rate of execution against a fixed set of known methods.

There is a fifth claim, exploit generation, which is not obviously throughput and is the only one I consider a live question. I take it up below, after the easier objections, because it is the one that could beat me.

Two senses of "smarter"

Before going further I have to be honest about a word, because there is a cheap version of this argument and I do not want to be caught making it.

Most AI researchers use "intelligence" operationally. If a system solves an expanding range of difficult novel tasks, that is intelligence, and asking what is happening inside is beside the point. On that definition, arguing that AI is not getting smarter looks like redefinition in service of a conclusion.

So let me state the claim in both registers. In the operational sense, my position is that the set of task types an offensive system can solve is fixed and inherited from human work, and only the cost per task is falling. That is an empirical claim about capability, not a philosophical one about minds, and it can be checked. In the explanatory sense, which is where the second half of this essay goes, the claim is about why that ceiling exists.

If the operational claim turns out to be false, the philosophy does not save me. I have written the test at the end of the piece, and it is deliberately not a test about consciousness or understanding.

The distinction that matters

David Deutsch is a physicist at Oxford, best known for the theoretical work that established quantum computation as a field. In the world of security, he is worth the detour for one reason: he is unusually direct about what intelligence is for. His position is that intelligence is the capacity to generate explanations, not the capacity to recognize statistical regularities, and that the two are so often conflated that most discussion of machine intelligence talks past itself. Whether or not you accept the conclusion, it is the sharpest available tool for the question in front of us.

He has spent two decades arguing that knowledge grows through the creation of explanations, not through the extrapolation of patterns. In The Beginning of Infinity he makes the case that induction has never been how anything was discovered. You do not arrive at general relativity by observing more falling apples. You arrive at it by conjecturing an explanation of what gravity is, and then subjecting that conjecture to criticism severe enough to kill it.

His position on artificial general intelligence follows from this. We have not built AGI, in his view, not because we lack compute or data, but because we do not yet have a theory of what creativity actually is. A system that predicts the next token from a distribution of prior tokens is doing something genuinely useful and genuinely impressive. It is not doing the thing that produces new explanations.

You can disagree with Deutsch about a lot. What is hard to disagree with is that the distinction he is drawing is real, and that it maps onto offensive security with unusual precision.

Vulnerability research divides cleanly into two activities. One is the invention of a bug class: someone had to first conceive of return-oriented programming, of prototype pollution, of request smuggling, of prompt injection. That is explanatory work. Someone built a model of how a system was supposed to behave, found the model wrong, and articulated why. The other is finding instances of a known class in a new target. That is search.

Search is most of what we do. It is most of what any offensive team does, and there is no shame in it. But it is worth being precise about which one the machines are good at.

Discovering a behavior is not explaining a bug class

The obvious objection at this point is that machines have already surfaced things nobody anticipated. Emergent model behaviors. Jailbreaks that work for reasons their discoverers cannot articulate. Attack techniques found by automated search rather than by human insight. Doesn't that count?

It counts as discovery. It does not count as explanation, and the gap between them is the whole argument.

Take automated adversarial suffix generation. Optimization procedures produce token sequences that reliably break model alignment, transfer across architectures, and look like line noise to a human reader. These are real findings with real impact. And to a first approximation, nobody can tell you why those specific sequences work. The strings were found by gradient search over a space that a person defined, evaluated against a criterion that a person specified. The explanation, where we have any, was supplied afterward and by humans.

That is the pattern across every case I know of. A machine surfaces an anomaly. A person builds the account of what the anomaly means, and that account is what turns one finding into a class that generalizes to systems nobody has tested yet. Prompt injection became a category because someone articulated the underlying confusion between instruction and data. Until that sentence existed, there were only weird outputs.

So yes, machines discover. Fuzzers have discovered for thirty years. Discovery is search plus a criterion, and both the search space and the criterion are inherited. Explanation is the thing that expands the space, and I have not seen a machine do it.

What the agents actually do

In our own work, autonomous agents find instances at a rate no human team matches, and have produced nothing resembling the invention of a class.

They enumerate faster than a human. They chain known primitives with more patience than a human. They read source and spot the shape of a familiar flaw at a speed no consultant matches. Turn them loose on an environment and they will find the misconfigured storage bucket, the injectable parameter, the trust boundary that someone drew wrong.

Two cases from a single engagement make the point better than a statistic would.

The first is the agent at its best. Against a client QA environment it retrieved an OpenAPI specification that was being served without authentication, and it flagged a user impersonation route buried in a long inventory of endpoints. It was right to. The specification declared that route's security requirement as an empty array, which is not an inference about weak authentication but a statement that none applies, and the same document exposed a set of secret management paths. A person then built the request chain that confirmed the route answered without credentials and returned a valid session token. Critical severity, client notified ahead of the report.

I want to give that its full weight, because it is impressive and because the flagging was the machine's, not a human's. It parsed a document nobody had read yet and picked out the one route that mattered.

And every class involved was old. Unauthenticated API documentation exposure. Broken access control. Privilege escalation through an impersonation endpoint. All three appear in testing methodologies that predate the agent by many years. What the agent supplied was speed and attention. What it did not supply was a category.

The second case is the same agent, the same day. It probed for a well-known unauthenticated RCE in an edge management interface, received a redirect to an ordinary application login page, and could not classify that as a negative result. Instead of recording that the target was not exposed, it built a finding out of the artifacts in front of it: pre-authentication cookies and a CSRF token on a login form. The evidence it cited was real, and I checked it. The finding was not, because there is no session to hijack and no authenticated action to forge before a user has logged in.

That is the thesis inside one engagement. Collection was excellent. Explanation was absent. The agent had no account of what makes something a vulnerability, so when the search came up empty it produced something shaped like a finding rather than nothing.

What agents do not do is come back and tell you there is a new class of flaw here that nobody had named. They find instances. Every instance belongs to a category that a person invented first.

Three objections that deserve real answers

Fuzzers were never creative either.

This is the strongest technical objection and I want to concede its force. AFL has no model of anything. It mutates inputs and watches for crashes, and it has produced an enormous share of the memory corruption findings of the last decade. Mechanical search finds real bugs. So "not creative" does not get you to "not dangerous," and anyone who argues otherwise is not paying attention.

The answer is that a fuzzer mines a space that someone else defined. The concept of a memory safety violation, the instrumentation that makes coverage measurable, the decision that a crash is interesting: all of that is explanatory work done by people, and the fuzzer operates inside it. LLM agents are a much larger and more flexible mining operation on a space that is still bounded by human explanation. That makes them more productive. It does not make them a different kind of thing.

Most attacks never needed creativity in the first place.

This objection is better, and it partially defeats me, so let me say what it costs.

The overwhelming majority of real-world compromise involves nothing inventive. Credential reuse. A known CVE on an unpatched edge device. A phishing email. A permission that should not have been granted. If attacker success has never depended on creativity, then a technology that only improves throughput can still change the threat landscape substantially.

Here is where I think the argument holds anyway. The economics of uncreative attacks were already close to free. Credential stuffing did not become viable because of AI; it became viable when breach corpora became commodity and residential proxies became cheap. Phishing at volume was solved a long time ago. When you reduce the marginal cost of something that already cost almost nothing, the defender's problem does not change shape. It gets somewhat worse in volume and stays the same in kind, and controls that worked on Tuesday still work on Wednesday.

The place where I would revise this is targeting. Tailoring at scale is a genuine capability shift, and pretexting quality is one area where I expect the effect to be real and measurable.

I want to be careful about how much that concession costs me, because there is a tempting and dishonest way to absorb it. I could say that personalized phishing is only a faster query against human weaknesses, and therefore still throughput, and therefore no problem for the thesis. But an argument that can redescribe every capability gain as throughput after the fact is not an argument, it is a reflex.

So, plainly: this is a real improvement, and it stays inside the model for one reason only. Nothing was discovered. The manipulation techniques being deployed at scale are the same ones described in the social engineering literature for thirty years, and no machine has produced a new account of why people comply. What changed is that executing them well against a specific person stopped requiring an hour of human research. That is execution cost, and it is the largest such reduction I have seen. If someone shows me a machine-derived pretext that works because of a mechanism nobody had previously identified, that is a different conversation.

Automated exploit development.

I said earlier this was the one I take seriously, so here it is.

The claim is that machines are moving past finding bugs and into weaponizing them: take a crash, determine exploitability, defeat the mitigations, produce a working primitive. DARPA has been pushing directly at this for a decade, from the Cyber Grand Challenge through the AI Cyber Challenge, and the systems involved do real work on real code. If any part of offensive practice looks like invention rather than search, it is this one, because exploit development feels creative from the inside. Ask anyone who has spent three weeks on a heap groom.

My answer is that exploitation is composition, and composition is not invention.

Every step in a modern exploit chain draws on a technique someone published. Return-oriented programming to survive non-executable memory. An information leak to defeat address randomization. Grooming to control allocator state. Each of those was a person building an account of why a defense could be circumvented, and each arrived with an explanation attached. What an automated system does is select and sequence from that inventory faster and more exhaustively than a human, against a target where the search is well defined and success is unambiguous. A working exploit is a very good oracle, which is exactly the condition under which mechanical search performs best.

But I want to be honest about where this leaves me, because this objection lands closer than the other two.

If exploit development really is composition all the way down, and machines compose better than we do, then the boundary I am defending is thinner here than anywhere else in the discipline. Composition at sufficient depth becomes hard to distinguish from invention by inspection. I think there is still a difference, and that the difference is whether the resulting technique comes with an account that transfers to systems the machine never saw. But if my thesis breaks, I expect it to break here first, and I would rather say so than be shown it later.

The forecasting problem

There is a second claim in this essay, and it is bigger than the first. It is also where the industry spends the most money on the least defensible product.

Deutsch, following Popper, separates prediction from prophecy. Prediction operates inside a known explanatory framework and is legitimate. Prophecy makes claims about the content of future knowledge, and it is not possible, because to specify a future discovery in enough detail to predict it is to make the discovery now.

Nearly every "top threats of 2027" report is prophecy. So is most AI capability forecasting, in both the optimistic and the catastrophic direction. If you cannot know what will be discovered, you cannot build your defensive posture around the specific content of future attacks.

What you can do is invest in the rate at which you detect and correct errors. That is not a rhetorical dodge. It is a concrete budget argument for detection engineering, for continuous validation, for reducing the interval between a control failing and someone noticing, and against buying a roadmap keyed to a threat taxonomy that will not survive the fiscal year.

What would change my mind

An argument that cannot fail is not worth making, so here is the falsification condition.

I will consider this position refuted when an autonomous system produces a novel class of vulnerability together with an explanatory model that correctly predicts instances in systems no one has yet examined.

Not a clever chain of known primitives. Not a bug in a target nobody had looked at. Not a name attached to a finding after the fact.

The predictive clause is the part that matters, and I want to be clear that I am not raising the bar to protect myself. Raising a refutation bar makes a claim harder to kill, which is a vice rather than a virtue. I am tightening it because the looser version protected me in a different way: "a novel class" is vague enough that I could dismiss any candidate as mere labeling, and a test I get to adjudicate is not a test. Requiring prediction hands the adjudication to anyone willing to go check.

It is also the bar human researchers already clear, which is what keeps it from being unreachable by construction. Request smuggling was not a name for one broken proxy. It was an account of what happens when two parsers disagree about where a request ends, and it predicted failures in parser pairings nobody had examined. Prompt injection predicted failures in application architectures that did not exist when it was described. That is what an invented class does, and it is the same standard I am applying to the machines.

Note what this test does not require. It says nothing about whether the system understands anything, or is conscious, or is really thinking. It is a claim about output that either shows up in the literature or does not. That is deliberate. If my argument only worked on Deutsch's definition of intelligence and collapsed on the engineering definition, it would be a word game, and word games are exactly the kind of easy-to-vary explanation this essay is against.

I do not think it has happened. If it has, I want to be shown, and I will write the correction.

Until then the working assumption on my team is that we are dealing with an extraordinary increase in throughput applied to a fixed repertoire, and that the correct response is operational rather than existential. Faster, not smarter. Plan accordingly.