Because it doesn’t really confer the advantage they claim, especially compared to e.g. paying an equivalent amount of money to do traditional security scanning.
It’s much better to play of FOMO and hype than to let everyone use it and be underwhelmed.
There's a huge number of security issues coming out in recent months, especially via Anthropic (glasswing etc). We don't have to take their word for it: look at the code. Some open source maintainers are talking about burnout due to spending so much time patching.
This isn't an "are LLMs net good or bad" argument. It's "are they finding many new security issues or not?". If it's the latter, we want to deal with it no matter where the issues are coming from.
I’d expect patching existing codebases to be an eternal treadmill as better models come about.
No, I don't think all bugs are fixed. The point of the project (glasswing etc) was to fix as many as possible in the core software the world runs on before the capability to find vulnerabilities is available to everyone (black hats included). Which may only be a few months.
I do think everyone expects it to be an ongoing treadmill: models get better, find better vulnerabilities, etc.
I react to that by leveraging a very useful but probably poisonous to society in the long term because humans aren’t good at having things that make them lazy tooll to try to mitigate the negative effects that it will definitely have if left to its own devices. I don’t see the point in raw resistance at this juncture.
IMO, the people spreading hype and fear are not neutral actors; if I just disagreed I wouldn't care. But I think they're causing actual harm based on a premise that isn't true. People are losing jobs. People are losing leverage in their work choices. Or if you want to be a cold capitalists, corporations are suffering after they have to rehire the workers they let go prematurely. That's why I put up resistance to it, because I think it's important right now that we don't accept the narrative being sold to us, nor the societal deal we're being offered (well, more railroaded into), both of which are bad.
It has enabled my team to approach and achieve a project that would have required 4x the staffing, at a minimum, 2 years ago. We are guiding the generation of more bug-free, lighter, more tested, more maintainable, better documented code at 1/4 the cost.
We can digest information as a team at 10x the speed, and we can now put volumes of reference resources at our immediate, context aware lookup in ways that were impossible 3 years ago.
It’s true that we are not just using the generic harness; our environment includes hundreds of custom tools , terabytes of reference material on rag, 8 custom local models (deployed trained and tuned by automation) hardware interfaces so that our models can interface directly to our prototypes and run tests, characterization, calibrations, firmware updates, and data dumps.
Most of those tools were one shotted by the AI itself, for a dollar or two each. Whenever we need a new automation capability we just roll it out, and even if it needs hardware it’s usually ready in two or three days, if software only 10 minutes. (Our in house tools don’t have to be as well documented, well written, or resource efficient as our production systems, since humans never even use them, and when we need a new feature we usually just have our AI tooling agent swarm start from scratch using the original as a rough guide)
So we are using AI as the core of our development and design process. If you’re not, you’re arguably “holding it wrong” IMHO.
We’re working to make sure that the next industrial revolution is friendly to humans and useful to people, not just corporations. Or trying to. I’ve got kids, and I’m really concerned about the world they are inheriting, so I’m trying my best to make it a little less terrible if I can.
Here's the curl project talking about the strain they're under from real reports (despite being a mature and well-vetted project):
> A thirty years old project could make you think you’ve seen most things already, but we have not been in this situation before.
> The rate of incoming security reports is 4-5 times higher than it was in 2024 and double the speed of 2025 – meaning that on average we now get more than one report per day. The quality is way higher than ever before. The reports are typically very detailed and long.
- https://daniel.haxx.se/blog/2026/05/26/the-pressure/
---
Linux kernel maintainer Greg Kroah-Hartman:
> "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now."
- https://www.theregister.com/software/2026/03/26/linux-kernel...
---
And ffmpeg, who previously complained about slop, 2025: https://xcancel.com/FFmpeg/status/1984220199193891166
Now say serious issues are being found, 2026: https://xcancel.com/FFmpeg/status/2066169070387413147
(I only point out their previous stance to show that they're not coming from pure AI hype.)
That scale of improvement, btw, I still highly doubt, as slop largely originates from people either negligently or misguidedly directing their agents to completely autonomously find and report bugs. There's always going to be more noise than signal from random people doing random things. ffmpeg cited an actual product, not arbitrary netizens.