What's this about?
An essay-paper asking what happens when AI makes *finding* vulnerabilities cheap: the bottleneck moves from discovery to remediation, and the world's stock of bugs shifts from "unknown" to "known and unfixed."
What exactly changes?
Today an unpatched bug is mostly safe because nobody has found it. When discovery is cheap, every unfixed bug should be presumed found — by defenders and attackers alike. The backlog becomes the battlefield.
Why is this worth noting?
It's the strategic frame for this week's news — AISLE's curl CVEs, Astra's incidental zero-days. Patch capacity, not scanner capacity, becomes the scarce resource, and disclosure norms built for scarce discoveries may not survive abundant ones.