WHY AI LEARNED TO ATTACK BEFORE IT LEARNED TO DEFEND

Summary from the TLDR InfoSec newsletter

Offensive AI is outpacing defensive AI due to a structural asymmetry: offensive exploits provide a clear verification "oracle" (the exploit either lands or fails), allowing reinforcement learning loops to train attackers much faster than defenders. The industry is actively experiencing this imbalance: Anthropic's Project Glasswing recently surfaced over 10,000 high- or critical-severity flaws, far outpacing the two-week average patch time, while OpenAI's Daybreak Red achieved a roughly 95% success rate on advanced offensive security tasks. This rapid offensive acceleration, illustrated by the Hugging Face breach in July and the rise of highly capable open-weight models, highlights a growing threat landscape where AI substitutes human effort on offense but only assists on defense.