In one line: For a decade, the fight over encryption has been settled by an unspoken compromise — no backdoors, but governments get to buy their way in through software flaws. AI is now eating the flaws.

The argument that split the security world

In mid-August, Johns Hopkins cryptographer Matthew Green published a blog post and a social thread that ricocheted through the security community. His worry was not the one you would expect from a privacy researcher.

“I’m concerned that AI is going to make software much too secure,” he wrote.

Read that twice. Green’s fear is not that AI will make systems weaker. It is that AI will make them so strong that the workaround everyone has quietly relied on stops working — and the backdoor debate comes roaring back.

The truce nobody signed

Rewind to 2014. The FBI’s “going dark” campaign warned that consumer encryption would blind investigators. Then Signal, WhatsApp, and iMessage shipped end-to-end encryption to billions of people, and phone makers turned on device encryption by default. Real-time wiretaps became largely impractical.

And yet: arrests kept happening. Cases kept getting made.

The reason is what Green calls an uneasy truce. Rather than legislating deliberate weaknesses into consumer products, Western governments opened their wallets instead. They funded a commercial exploit industry — firms that hunt unknown vulnerabilities, package them into working intrusion tools, and sell them to state buyers.

Nobody voted for that arrangement. But it produced a workable equilibrium: encryption stayed intact for everyone, while surveillance stayed targeted, expensive, and at least loosely case-by-case.

That equilibrium has one dependency. It only holds while bugs exist in sufficient supply.

Why AI changes the supply curve

Large language models have moved from writing vulnerable code to systematically finding vulnerable code. The evidence is no longer hypothetical:

• Google’s Big Sleep agent, built by DeepMind and Project Zero, surfaced a real SQLite zero-day (CVE-2025-6965) and reported roughly twenty vulnerabilities in open-source projects in a single disclosure batch, with each flaw found and reproduced by the agent before a human reviewer touched it.
• XBOW, an autonomous offensive system, climbed to the top of HackerOne’s US leaderboard in 2025 — above every human researcher on the platform.
• The commercial pipeline has matured fast. Autonomous and AI-assisted agents are now earning named CVE credits across cloud services, media libraries, and operating systems.

Push that curve forward. If vendors can run adversarial models continuously against their own codebases and ship fixes at machine speed, the reservoir of exploitable, undiscovered flaws in mainstream phones and browsers drains. Not to zero — but toward scarcity.

Scarcity is the whole story. When exploits become rare and astronomically expensive, the exploit-purchasing model stops delivering. And a state that cannot buy access, but still wants access, has one lever left: mandate it.

Green’s darkest observation is that mandated access mostly injures whoever mandates it. A backdoor legislated in one jurisdiction weakens that jurisdiction’s own systems while leaving adversaries free to attack through it.

The counterarguments are strong

This is a genuine dispute among practitioners, not a settled forecast. Several people who make a living in offensive security push back hard, and their objections cluster into five:

1. Easy bugs die; hard bugs don’t. AI is excellent at pattern-matching memory-safety classes and injection flaws. The chains that actually matter for state-grade intrusion — multi-stage, logic-dependent, sandbox-escaping — are a different problem class. Those are not obviously on the same curve.

2. Reported ≠ discovered. One founder in the field estimates that for every AI-found bug that gets disclosed, roughly twenty are found and never reported. AI lowers the cost of finding flaws for everyone, including the people whose business model depends on not telling the vendor.

3. Finding is not fixing. EFF’s Eva Galperin makes the point that discovery volume and patch velocity are separate pipelines. Enterprise patching is a slow, political, backwards-compatible mess. A flood of new findings can easily outrun the organizational capacity to remediate them — and the same AI tooling is generating fresh vulnerable code through casual “vibe-coded” development.

4. Hardware hardening is the bigger obstacle. Two working exploit researchers said modern device mitigations already worry them more than AI does. The constraint on offense today is architectural, not analytical.

5. Political demand is not supply-driven anyway. Authoritarian governments have never waited for a technical justification to demand exceptional access. The push for backdoors arrives regardless.

Katie Moussouris of Luta Security lands where most of the sober voices do: current phones and laptops are nowhere near bug-free, and the serious institutional pressure for backdoors is probably still a political cycle away.

What this means if you build or buy software

This is not a policy curiosity. It is a roadmap input.

• Your patch pipeline is now the bottleneck, not your scanner. Detection capacity is about to outstrip remediation capacity for most organizations. If your mean-time-to-patch is measured in quarters, more findings will not make you safer — they will just make your backlog legally interesting.
• AI-assisted development is a two-sided ledger. The same tooling that accelerates delivery is measurably increasing the volume of weak code entering production. Shift-left security controls need to move at the same speed as your code generation, or the net risk position gets worse.
• Encryption policy is a product risk, not a compliance footnote. If exceptional-access mandates resurface, they will land on architecture decisions being made right now — key management, cloud residency, device-side processing. Vendors with credible zero-knowledge designs will have a commercial story competitors cannot copy quickly.
• Sovereignty pressure accelerates. Green’s most under-discussed prediction is that mandated access drives non-domestic buyers away from the mandating country’s software stack. For anyone selling B2B software across borders, that is a go-to-market variable.

The debate is not really about whether AI finds bugs. It clearly does. The open question is whether defenders can absorb what AI finds faster than attackers can weaponize what it misses.

If defenders win that race, we get safer software and a policy fight nobody has rehearsed in a decade. If they lose it, we get the same policy fight — just with more breaches attached.

Either way, the truce that has quietly governed digital privacy since 2014 was never designed to survive this. It is worth deciding what replaces it before someone decides for us.