I think a better comparison for the parent is probably left-pad.

That sounds like a very reasonable thing to do, yes. If you ask Opus 5.5 to write you a dynamically typed interpreted language that can query a local SQL database, implicitly parse HTML form submissions, and be embedded in HTML templates interpreted by an Apache module, you'll probably have a usable alternative to PHP in 37 minutes. And if you ask it to do it in Rust with no unsafe, it won't have any memory error vulnerabilities.

I've been playing around with LLM red teaming different server stacks with known or intentionally vulns in there and seeing how much damage they can do.

The one situation where they really can't get anywhere profitable is a unikernel webapp. With no source and no shell they find the vuln but the worst they can do with it is possibly poison or exfiltrate data as a one off, or crash the server. Often they can't even figure that out. Can't even leave themselves a reliable way back in.

Of course the traditional problem with unikernels is that you have to port EVERYTHING you need yourself. But the cheapness of this is exactly what we're talking about so.

Looks like security through obscurity's back on the menu.

Yeah I guess, if they liked PHP. Could make a new version of ColdFusion if that's your thing too.

Genetic monocultures like bananas are at risk from a single species of fungus.