AI Bug-Hunting May Make Software Too Secure — and Revive the Backdoor Wars

Cryptographer Matthew Green argues that AI-powered vulnerability discovery is about to upend the uneasy truce over encrypted communications. Since roughly 2010, the spread of device encryption and default end-to-end messaging — Apple’s passcode-derived encryption, iMessage, and WhatsApp reaching a billion users — triggered the FBI’s ‘Going Dark’ campaign. That fight never resolved cleanly: the 2016 Apple v. FBI standoff ended not with a mandated backdoor but with a third party simply hacking the phone. For a decade afterward, agencies leaned on commercial offensive tools like GrayKey and NSO Group’s Pegasus, while vendors patched holes as fast as researchers found them, keeping backdoor demands in hibernation.

Green’s worry is that AI models tuned for vulnerability hunting — he cites a (fictional) Anthropic model plus OpenAI and Chinese labs — are now surfacing serious bugs faster than ever, and defenders are winning the race. Teams are burning down decades of vulnerability backlog and wiring AI scanners into CI pipelines before code ever ships. If, as he expects, well-maintained software largely runs out of remotely exploitable bugs within a couple of years, law enforcement loses the hacking capability that quietly replaced the backdoor debate.

The consequence, in his view, is that pressure for legally mandated ‘exceptional access’ will return in force. He sees this as self-sabotage: backdoors would mostly weaken the systems of the countries that demand them, opening fresh attack surface for foreign adversaries precisely as infrastructure security finally improves — and possibly pushing other governments off US software entirely. Notably, he offers no solution, framing the piece as an alarm rather than a plan.