Will AI find vulnerabilities that couldn't have been found by an elite human researcher?
From https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/: Encouragingly, we also haven’t seen any bugs that couldn’t have been found by an elite human researcher. Some commentators predict that future AI models will unearth entirely new forms of vulnerabilities that defy our current comprehension, but we don’t think so. Software like Firefox is designed in a modular way for humans to be able to reason about its correctness. It is complex, but not arbitrarily complex. By 2029, will this turn out to be false? Update 2026-05-01 (PST) (AI summary of creator comment): The market requires that AI finds vulnerabilities that elite human researchers could not have found, not merely vulnerabilities that they have not found. A vulnerability going undiscovered does not qualify if it was theoretically within human capability to find. Update 2026-05-01 (PST) (AI summary of creator comment): A vulnerability counts if it would be realistically impossible for a human to discover (e.g., because of the amount of context they would need to hold in their head to notice it). Update 2026-05-01 (PST) (AI summary of creator comment): A vulnerability qualifies if a human could not see it even when looking at the right place, because the amount of context needed to hold in one's head (e.g., various interacting functions) is too great. This is distinct from vulnerabilities that humans simply have not found — the key criterion is whether it was realistically impossible for a human to discover, not merely undiscovered. Update 2026-05-01 (PST) (AI summary of creator comment): The creator will subjectively decide the resolution, possibly deferring to the consensus of security people. The goal is to track whether the quoted claim from Mozilla will turn out to be false. Update 2026-05-02 (PST) (AI summary of creator comment): Vulnerabilities in AI systems are out of scope (e.g., finding adversarial inputs with AI does not count). The market is specifically about human-written/human-maintained code. Update 2026-05-09 (PST) (AI summary of creator comment): In some situations, the creator will resolve based on consensus of cybersecurity researchers. Clear resolution scenarios include: Resolves No: consensus among cybersecurity researchers that AI did not find such vulnerabilities Resolves Yes: consensus among cybersecurity researchers that a specific vulnerability could not have been found without AI Some cases may require subjective judgment by the creator.
