That's so true. Nobody gave a damn about those bugs because they were too hard to exploit, and companies had a mindset of "move fast and break things." Bugs were given low priority, and developers had no time to fix them since they were buried in higher-priority feature work as part of a cost-optimization effort. Almost all of the smart people who could actually exploit them were afraid of criminal charges. Now, lots of script kiddies are having fun with AI, and state-sponsored actors in different countries are using it to accelerate the discovery and exploitation of vulnerabilities. But instead of extending validation campaigns and allocating larger budgets for hiring and funding security audits, software vendors are mostly trying to lobby for limitations on models' capabilities and regulation of the field, like Amazon reportedly did[1], despite even OpenAI and Anthropic offering subsidized[2,3] access to their frontier cybersecurity models, which are significantly better than those malicious actors have.

[1] https://www.theverge.com/ai-artificial-intelligence/949601/a...

[2] https://openai.com/index/coordinated-disclosure-of-critical-... - "To help more defenders use these capabilities, we’ve committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, focused on organizations with limited security resources protecting essential services."

[3] https://www.anthropic.com/glasswing - "Anthropic is committing up to $100M in usage credits for Mythos Preview across these efforts, as well as $4M in direct donations to open-source security organizations."