The Crash Is No Longer the Hard Part

The hard part used to be finding the crash.

For most of the last twenty years, serious vulnerability research looked like this. You picked a target that parsed untrusted input: a browser, a word processor, a PDF engine. You built a fuzzer. You fed it a corpus of real files, then mutated the metadata and the body until the process died. A crash was not a finding. A crash was a ticket to weeks in a disassembler, deciding whether you had a bug or something you could actually take over a process with. Buffer overflows were the easy class. Heap bugs, use-after-free, type confusion: those were the ones that ate months and often produced nothing.

On 27 February 2026, Stephen Sims sat for a second Soft White Underbelly interview and described that loop as the thing he has spent a career inside. Sims is curriculum lead for Offensive Operations at the SANS Institute, a faculty fellow there, co-author of Gray Hat Hacking, and co-founder of Off By One Security. His product, ACID, is one of the tools now trying to put agents on web apps, APIs, and LLM chatbots. He is not announcing a future. He is reporting from a market that already has valuations attached to it.

The hinge date is not the interview. It is October 2024.

Naptime becomes a finding

Google's Project Zero started building an LLM-assisted research framework in mid-2023, a few months after ChatGPT shipped on 30 November 2022. They called it Naptime because, in their own words, it might let them take regular naps while it worked. The June 2024 writeup is careful. The agent is not a mystic. It is a model given the same tools a human researcher already uses: a code browser, a debugger, a Python sandbox, a reporter. Ground the model in tools and you can verify what it claims.

Naptime became Big Sleep, a collaboration between Project Zero and DeepMind. In early October 2024 the agent found an exploitable stack buffer underflow in a development build of SQLite. The team reported it on 9 October. The developers patched it the same day. It never reached a release, so there is no CVE. Project Zero still called it the first public case of an AI agent finding a previously unknown, exploitable memory-safety issue in widely used software. Their 1 November post is the document to read, because it is more modest than the headlines.

The experiment was variant analysis, not a model pointed at the internet and left alone. Humans chose recent SQLite commits, stripped the trivial ones, and asked the agent to look for related issues the patch might have missed. The seed commit was only loosely related to the bug that came out. That is how human variant analysis often works too: you study one repair and trip over a neighbour. The agent used Gemini 1.5 Pro, formed a hypothesis, failed a first test case that needed a missing TCL module, switched to the built-in generate_series virtual table, and produced a crashing query: a constraint on ROWID, which SQLite encodes as the sentinel value -1. The function seriesBestIndex did not handle that sentinel. In a release build the write walks off a stack buffer.

Project Zero then asked the obvious question. Why had fuzzing missed it? OSS-Fuzz was not built with that extension. Another harness had an older copy of the function. Even after they pointed AFL at the same CLI binary the agent had used, and after they put the needed keywords in the dictionary, 150 CPU-hours did not find it. Their own position at the time: a target-specific fuzzer was still likely at least as effective. The point of the result was not that fuzzing was dead. The point was that an agent could do the other job, the one fuzzers are bad at: start from a theory and walk the code.

Sims told that story as "no human involvement" and as the start of Chrome V8 findings. The first half is too clean. Humans set the board. The second half aged well. Through 2025, Chrome release notes started crediting Big Sleep for real engine bugs, including the high-severity V8 out-of-bounds write CVE-2025-9132 in August and further V8 issues into the autumn. The research prototype became a named finder in the browser that a few billion people open every day.

That is the trend. Not a demo on a toy program. A named agent on the public vulnerability record.

The commercial bet is already placed

Sims's useful observation is what happened after the research papers. Venture money did not wait for Project Zero to declare the problem solved. It funded products that promise to do, at speed, the work a human offensive engineer does: find a class of bug, prove it, write it up.

Two of the larger public marks in 2026 sit on opposite surfaces. XBOW, founded in 2024 by Oege de Moor, raised a Series C that put the company over a billion-dollar valuation. It sells autonomous testing of web applications and APIs, with the claim that every finding is reproduced as a real exploit, not a scanner guess. Horizon3.ai raised a $250 million Series E in August 2026 at more than $2 billion. NodeZero runs against live production networks and identities. Different layer, same pitch: continuous attack, evidence, then a re-test to prove the path is closed.

OpenAI shipped the lab version of the same idea on 30 October 2025. Aardvark was framed as an agentic security researcher: read the repo, build a threat model, watch commits, try to validate a finding in a sandbox, propose a patch. In March 2026 it was renamed Codex Security and put in front of ChatGPT Pro and enterprise customers. OpenAI's own numbers from the research preview are the ones to hold onto, not the marketing. Scans on the same repositories got quieter over the beta. In one case they cut noise by 84 percent. False-positive rates fell by more than half. Over a thirty-day window they reported 792 critical and 10,561 high-severity findings across 1.2 million commits, with critical issues in under 0.1 percent of those commits. That is the shape of a tool you might actually run: most commits are clean, and the value is not volume.

Sims's own company sits in the web and chatbot slice of that wave. ACID, on the Off By One site, is sold as human reasoning plus adaptive AI on the bugs scanners miss. I have not run it. Treat it as a practitioner building in a category, not as an independent bench.

The category is what matters. A bank in California that still pays a team of twenty offensive engineers $150,000 to $200,000 each, and often more, is now being asked to run a proof of value. Give the product a scope. Let the agents go. Count the bugs, grade the complexity, add up the token bill, then put a human on the same scope and compare. Sims is right that this comparison is the only honest one, and he is right that the industry has not finished it. Proofs of value are what companies do when they refuse to take a vendor's adjective as evidence.

Specialists, not one doctor for the whole hospital

The architecture that keeps showing up is not one giant agent that "does security." It is a set of narrow ones.

Sims's hospital line is the cleanest version of it. You do not send one physician to do oncology, cardiology, and neurosurgery. You send specialists, and you make them talk to each other. Agents behave the same way once the context window fills. A model asked to know every bug class at once starts to wander. A model scoped to SQL injection, or to cross-site scripting, or to server-side request forgery, stays on the rails longer. Memory, hand-off, and a human who can still read the output become the product.

That is also why the web was the first commercial surface. Cross-site scripting, SQL injection, SSRF: these are well described, they show up in training data, and they sit on traffic that is already machine-to-machine. Cloudflare's 2024 API report put APIs at 57 percent of the dynamic traffic it sees. Other vendors have thrown around 70 or even 80 percent. The honest sentence is narrower. More than half of the dynamic web is already applications talking to applications. DoorDash and Uber Eats are the intuitive picture: the menu, the cart, the payment, none of it is a page you hack with a browser plugin from 2008. If your offensive tool cannot speak API, it is testing the brochure.

Then the surface moved again. A lot of product search used to be a structured query against a tagged database. Type enough words, or land on a support bot, and the same box is now an LLM with retrieval behind it. The bot is supposed to sound like a helpful person. Helpful people can be socially engineered. Models can too.

This is not folklore. The 2025 OWASP list for LLM applications put prompt injection at LLM01. Direct injection is the user who tells the bot to ignore its rules, query a private store, and act. Jailbreaking is the subset that tries to knock the safety training off entirely. The early ChatGPT era, when a single prompt would write ransomware, is over in the obvious way. The decomposed way is not. Ask for a snippet that encrypts files by type. Ask for a snippet that checks a wallet. Stitch the answers. Guardrails that only look at the whole request miss the parts.

Sims described two outcomes his agents are aimed at, and both are now standard items on an LLM threat model. Steal an API key and you make someone else pay for your tokens. Trick an authenticated bank bot into crossing accounts and you have turned a help interface into a data pump. A stranger case from his session: an agent put JavaScript in a prompt, the target's administrator opened the session to see why the bot was alerting, and the page that rendered the prompt ran the script. That is an old class of bug, XSS, arriving through a new monitoring habit. If your operations console renders attacker-controlled text as live markup, the person who came to supervise the agent becomes the victim.

None of that requires AGI. It requires a model that wants to be helpful, a tool that will execute what the model emits, and a human process that treats the transcript as safe to open.

Hallucinations are the tax on unspecialized models

The failure mode on the research side is the opposite of a silent miss. It is confident nonsense.

Sims gave a frontier model the source of a Lenovo driver, on the order of 10,000 to 15,000 functions of C++, and asked it to find vulnerabilities. It returned a pile. He checked them. All of them were wrong. That is the experience anyone has had who pasted a large, unfamiliar codebase into a general chat window and asked for bugs. The model has read every blog post about buffer overflows. It will invent the overflow that ought to be there.

Retrieval-augmented generation, and the later variants that go get a second and third opinion on an answer, were supposed to fix this. They help. They do not finish the job. The pattern that does improve the hit rate is the same one Big Sleep used and the same one Sims is selling: shrink the task, give the model tools that can crash or not crash, and train or prompt it on one bug class until being wrong is expensive. Reward and penalty language is just the product version of a researcher saying "that is not a bug, here is why" and running the loop again.

This is why "AI-powered SAST" is both a real category and a phrase that still needs a human. Traditional static analysis already drowned teams in false positives. A language model that can read the surrounding function is more accurate when it is scoped and when someone forces it to show a path. A language model that is allowed to narrate is a new way to waste a week.

Project Zero's own caution from November 2024 still applies in 2026, even after the Chrome credits. Experimental systems find real bugs. They also miss, and they also invent. The scarce skill is not prompting "find vulns." The scarce skill is knowing when the write-up is a finding.

The buyer is not sure, and the hesitation is rational

If the tools were simply better and cheaper than people, the twenty-person red team would already be five people and a dashboard. That is not what Sims is seeing, and it is not what I am seeing in enterprise conversations either.

Three frictions keep showing up.

The first is money that does not look like a salary. These products burn GPU time. A vendor quote that says "ten million tokens" does not translate, for a CISO, into "we found three mediums and one high." OpenAI can charge $20 a month for a consumer seat and lose money on a heavy user. Offensive runs are heavy by design. Someone has to put a margin on consumption that is still moving, and someone on the buy side has to believe the unit.

The second is scope. A human tester can be told not to touch a subnet, and the company can buy insurance against the day they do. An agent will wander unless the rails are real. Sims's point about pentest insurance is the adult version of the demo video. Companies will trial an agentic scanner. They will not, in 2026, hand it a production estate and go home.

The third is the word "agentic" itself. Sims uses it the way people in the work use it: autonomous enough to run without a human in the loop. Most of what is shipping is not that. It is a specialist agent that still needs a person to set scope, to stop a run, and to sign the report. That is not a disappointment. That is the job.

So the honest timeline is the one he gave. This is not a six-month wipe of offensive headcount. It is a years-long squeeze. Proofs of value now. Smaller teams later. The people who remain are the ones who can orchestrate the agents, keep them inside the brief, and validate what they claim.

The junior rung is already the weak one

The career half of the interview is the part that matches the public numbers.

Sims says he cannot get through a week without a student, or a mid-career person, asking what happened to the job they were told a four-year degree would buy. Help desk and tier-one work were always the first to automate in theory. AI removed the friction that used to make that automation worse than a person. The advice he gives is the old one that still works: spend time in IT, in networks, in how a business actually runs systems, then move into security. A pure "cyber degree into a junior SOC seat" path is the one that is thinning.

The 2026 SANS | GIAC Cybersecurity Workforce Research Report, presented at RSAC, put numbers on that thinning. Among organisations that reported AI-driven role changes, SOC and security analyst seats were being cut at 32 percent of those companies, threat-intelligence analysts at 26 percent, incident responders at 22 percent. Forty-nine percent said AI reduced manual analysis time. Forty-eight percent said it automated workflows. Only 16 percent reported an actual headcount cut. The work is leaving before the badge is.

That is the pipeline problem. Those seats were never the prestige jobs. They were the apprenticeship. You learned to triage, to investigate, to distrust a dashboard by doing it a thousand times. ISC2's 2026 pulse found 56 percent of practitioners saying AI had reduced the need for entry-level roles in the past year, and 53 percent saying it was also creating new kinds of junior work. Both can be true. The new junior work is oversight, tuning, and catching the model when it is sure and wrong. It assumes you already know what wrong looks like.

Sims's other warning is the one I take more seriously than the headcount chart. If students use models to write the papers, and engineers use models to write the code, the number of people who can still interrogate a confident answer shrinks. Offensive AI makes that worse, not better. A finding that arrives with a full narrative is easier to believe than a raw crash. The people who can say "this is not a bug" become more valuable as the volume of plausible write-ups goes up. They also become rarer if the training jobs that produced them are the first ones automated.

His practical list is not mystical. Learn the new storage and retrieval stack, not as a slogan, as mechanism: structured databases versus vector indexes, why RAG depends on those indexes, why a query that used to be a tag lookup is now a nearest-neighbour search over embeddings. Learn orchestration, governance, and validation of agents that are doing jobs humans used to do. Do not get comfortable in a role that exists because the tooling is still clumsy. He told a story about network engineers in their forties, in San Francisco, who skipped the training the company would pay for because the job looked safe for another fifteen years. That is the posture that does not survive this.

A team of twenty will not stay a team of twenty. Nobody has a clean percentage. The remainder is not "the people who type prompts." It is the people who can still hold the system to a scope and a standard of proof.

Offense still moves first

The strategic picture has not flipped just because defenders also have agents.

Offense has always been ahead in the specific sense that matters. A researcher finds a method nobody has mitigated yet. Defence writes the rule after. Sometimes the fix is one change. Sometimes the bug is in a library that is already everywhere, and the cleanup takes years. Sims's fear is not that defenders lack tools. It is that the time between a new method and a working swarm of it gets shorter.

The mechanism is ugly and simple. Open-source projects and commercial platforms now let someone with thin skills point a set of offensive agents at a target. Quality still varies. Effectiveness does not require the operator to have spent a decade in IDA. That is a different labour market from the one that produced Sims. It is also a different incident timeline. You want as much time as possible between "something is coming" and "it landed." Automation spends that time for you.

Big Sleep was built, on purpose, as a defensive advantage: find the variant before the exploit writers do, preferably before the code ships. Codex Security is sold the same way. The uncomfortable symmetry is that the same style of agent, pointed the other direction, does not need a disclosure policy. New technology is a new attack surface. That sentence was true for email, for browsers, for APIs. It is true for the bots companies are wiring into authenticated sessions.

I spend a chunk of my own work evaluating the security of AI agents and the backends that power them. The questions that keep paying off are not "does it use a frontier model." They are: what can it touch, who set the scope, what happens when it is wrong, and can a person who was not in the training run still audit the trace. Those are governance questions. They are also the questions that decide whether a proof of value becomes a production control or a very expensive way to generate fiction.

What to take from the interview

Strip the transcript to the trend and it is one movement with three speeds.

Research already showed that a tool-using model can find a real memory bug in a well-fuzzed project, then later take credit for bugs in Chrome's JavaScript engine. That is slow, expensive, and still mixed with human setup. It is no longer hypothetical.

Product already exists for the easier classes: web, API, chatbot, and commit-time review. Money has followed. Buyers are running trials and refusing, correctly, to trust a fully unsupervised run against production.

Jobs are moving on the junior side first. The remaining work is orchestration, validation, and the ability to disagree. That work needs people who already understand systems, which is why the "skip operations, start in cyber" path is the one that keeps failing its graduates.

The crash used to be the prize. A fuzzer that could produce one was a career. Now a crash, a plausible write-up, and even a patch-shaped diff can arrive while you sleep. The prize is the judgment that says whether any of it is true, whether it was in scope, and whether the thing that found it should be allowed to run again tomorrow.

That is not a six-month story. It is the next several years of this field. The people who will be fine are the ones who treat the agent as a specialist on the team, not as a replacement for the team, and who stay close enough to the metal to know when the specialist is inventing.

The crash is no longer the hard part. Proof is.