Project Glasswing: AI Finds the Bugs, But Humans Still Bottleneck the Fix

Project Glasswing demonstrated that AI systems can surface software vulnerabilities at a pace and scale human auditors cannot match. The finding pipeline is no longer the constraint — machine-driven discovery reliably produces more validated bugs than teams can realistically triage.

The bottleneck has shifted downstream. Remediation still depends on human engineers to reproduce, prioritize, and patch, and that workflow was never designed for the volume AI now generates. Backlogs inflate, mean-time-to-fix stretches, and the window between discovery and exploitation widens rather than closes.

The implication is structural: organizations that adopt AI-driven vulnerability discovery without re-architecting their remediation pipeline end up with a more accurate map of their own exposure and no faster path to closing it. The next defensible position is AI-assisted patching, automated regression validation, and risk-based triage — not more finders.