I see a lot of conflicting opinions on this, and this is a nuanced discussion. Here's what I see on the ground:
For context, we built a frontier AI security tool called Apex (#1 on the HackerOne business leaderboard for 2026, over $100B in exploitable funds saved), and have found severe critical bugs in both open source and closed source codebases.
We've found and reported issues in pretty much everything: compilers, smart contracts, layer-1 blockchains, browsers, operating systems, old Linux libraries, formal verification solvers, GPU code, fortune-500 companies, you name it. If you're reading this, it's pretty likely we found something in a piece of software you were using.
1. AI has changed the economics of security.
There's no such thing as an impenetrable system; a highly motivated, well-resourced attacker will be able to hack into anything they want to. So security is really about using your resources effectively to make attacking as expensive as possible.
AI has completely changed the economics here. It's pretty obvious to people how AI has changed the economics around building software. If you can describe what a software application is supposed to do, getting an MVP is just a prompt away. There's a similar phenomenon in security happening right now that people are slowly waking up to.
2. The gap between attackers and defenders:
Nicolas Carlini, a security researcher from Anthropic, gave a wonderful talk last month at a security event in San Francisco that I attended, where he discussed how security has historically had a balance between attackers and defenders and how new technology has favored defenders more than attackers. However, he warns that this dynamic is changing with the accelerated improvements in AI. A lot of software out in the open will be vulnerable for a while to people poking around with new tools (claude "find me a critical bug, make no mistakes"). In the long term, defenders may win, and we may have very secure software and things rewritten in safer languages, but it's pretty clear there will be a short-to-medium-term security apocalypse.
3. On open-source vs closed source
From what I see building a frontier security tool, it's far easier to break fully open-source code than closed source. We literally have a factory that we can feed open-source code into, and it'll spit out exploits. With closed-source binaries, an experimental version of this factory has surprised us; for example, we have a High severity bug on then closed-source Claude Code that Anthropic paid a bounty for (this was before the whole leak). But putting closed source binaries in our factory is largely hit or miss, it takes expert human labor to make it work on closed-source binaries today.
The counterargument of "but ... LLMs will write a perfect decompile" is not as simple as you'd put it. I can't go into the specifics without giving away some of the work we're doing there. Give it a try, pick an important closed source binary and see how much work it takes to get a useable reverse. It's some work today, and the results are not yet reliable.
As of now, being closed-source buys you more time vs open source when it comes to the AI security apocalypse. But this may be as short as a few months. I say this as someone who has written a lot of open-source code. It's time to rethink some of your assumptions from first principles.
"North Korea is willing to spend $100 million for a $300 million prize. You don't have $100 million to defend yourself"
Haseeb on why open source might stop being the default in crypto
"The pollyanna-ish kumbaya version of open source we've had over the last 20 years is going away"
"Crypto apps are open source but they're maintained by a single company. Only Drift uses the Drift contracts. That's really different from open source like Linux or Axios"
"There's such an asymmetry between attackers and defenders that this may end up pushing against open source as the default. Maybe they issue a zero knowledge proof that shows there's no admin key, but they're not going to decompile the code for you"