From Vulnerability Discovery to Scambaiting: Who Gets the AI Advantage?

I recently came across a blog post by Johann Rehberger on how AI agents are changing vulnerability discovery. While reading it, one claim caught my attention. Rehberger, referring to Leopold Aschenbrenner's Situational Awareness, suggests that the next 12–18 months might be rough as offensive capabilities arrive before patches. I wanted to understand why, so I went back to the original source. Part of the reason I was curious was that this came out of my thesis work, which I am preparing for publication with my advisors, and in the paper we studied an attacker-defender arms race in a very different setting, agentic scambaiting, and under our baseline assumptions the dynamic pointed the other way.

In Situational Awareness, Aschenbrenner looks at where the current direction of AI could take us over the rest of the decade. One of his main arguments is that AGI by 2027 is a real possibility. He builds that argument around the growth in compute, improvements in algorithms, and what he calls unhobbling. By unhobbling, he means the changes that could turn today's chatbots into agents that are able to work more like coworkers.

Reading this in 2026, that part stood out to me because we are already seeing the shift from chatbots to more capable agents. But when I actually read the security section of the paper rather than relying on Rehberger's summary, I noticed that Aschenbrenner's warning was much more specific than the framing I had picked up. He was mainly talking about AI labs protecting model weights and important algorithmic breakthroughs from sophisticated state actors. When I went back to Rehberger's post, the same idea seemed to be applied more broadly to attackers gaining an advantage as AI makes vulnerability discovery faster. That difference in scope is what made me want to look into the question more closely.

That left me with a question. Does faster AI capability growth necessarily give attackers the advantage, or does that depend on the kind of security problem we are looking at?

This came out of my thesis on strategic scambaiting, where we looked at what happens when both scammers and scambaiters use AI to scale and improve their operations. In this setting, both sides are getting more capable, but they are trying to do very different things. The scammer wants to identify real victims, avoid wasting time on baiting agents, and eventually get a payment. The scambaiter wants to stay convincing long enough to extract useful information such as mule accounts or cryptocurrency wallets.

That difference matters because an improvement for one side does not necessarily translate into the same kind of advantage for the other. A scammer can get better at detecting baiting agents, while a defender can get better at behaving like a real victim. The two capabilities also interact. If the defender becomes better at hiding the signals the scammer is looking for, then making the scammer better at reading those signals may become less useful. In our model, this interaction was important enough that when both sides improved at the same pace, the arms race favored the defender under our baseline parameters. Of course, this is one specific model of one specific security problem with specific assumptions, so I don't think it tells us that defenders generally have the advantage.

That result made me wonder whether the attacker advantage is less about AI capability itself and more about the structure of the security problem where that capability is being used. Looking at these two cases side by side made me think that the answer may depend less on how quickly AI improves and more on the kind of security problem we are dealing with.

In vulnerability discovery, an attacker may only need to find one weakness before a defender has a chance to identify and patch it. That naturally creates a window where faster discovery can benefit the attacker. Scambaiting has a different structure. The two sides are interacting with each other and adapting at the same time. A scammer can get better at detecting a baiting agent, but the baiting agent can also get better at looking like a real victim. In our model, improving mimicry reduced the value of better detection, which is one reason the defender could gain the advantage when both sides improved together.

That makes me hesitant to think about an attacker or defender advantage as something that applies to security as a whole. It may depend on things like who gets to act first, what information each side has, how expensive mistakes are, and whether an improvement by one side can directly reduce the usefulness of an improvement by the other.

I started looking into this because of the prediction that the next 12 to 18 months might be rough for defenders. What I am left wondering is whether that is something we can predict broadly for cybersecurity, or whether the answer has to be worked out separately for different kinds of attacker and defender interactions.