Imagine you live on a street where every house has the same locks, and a locksmith guild publishes a catalog of every lock flaw they find. Burglars read the same catalog. Now imagine one block gets a robot locksmith that works 24/7, finding and fixing flaws before the catalog even goes to print. The burglars don't get more break-ins on that block — but the houses on the next street over, still relying on human locksmiths, look comparatively worse. That's the mechanism here: frontier AI as a tireless, private vulnerability scanner, and the question is whether the catalog stays useful or the gap between blocks becomes the new risk. The paper exploits a specific policy event — Project Glasswing — which gave a small group of large US tech firms early access to Claude Mythos Preview, an Anthropic model purpose-built for finding software vulnerabilities. Thomas Mosk treats this as a natural experiment: treated firms (those with access) are compared against Chinese and Russian tech firms (without access) using the universe of publicly disclosed vulnerabilities (CVEs). The headline result is that treated firms more than doubled their vulnerability disclosures relative to untreated firms, with roughly 150% more high-severity vulnerabilities found, and — critically — they fixed reported flaws just as quickly as before the model arrived. The labor-market dynamics are where it gets interesting. External security researchers, the people who sell bug discoveries through bug bounties, reported about 50% fewer vulnerabilities in treated firms' code after Glasswing. But they didn't leave the market — they redirected their effort to other firms' codebases. The AI didn't destroy the bug-bounty ecosystem; it displaced it. Treated firms' code got scanned so thoroughly by the model that external researchers found slimmer pickings and moved to greener pastures. This is a clean substitution story, not a displacement-to-unemployment story. On the attacker side, the evidence is reassuring at first glance: the share of disclosed vulnerabilities exploited within one month fell by about two-thirds for treated firms, primarily because fewer vulnerabilities were already being exploited at the time of disclosure. The total number exploited didn't rise. The interpretation is that the AI helped defenders find and patch flaws before attackers could weaponize them — the robot locksmith was faster than the burglars. But notice the logical dependency: this works because the model's output stayed inside the defender perimeter. The paper's own conclusion flags that the restricted release creates a security asymmetry between firms in different countries. The identification strategy leans on the sudden, exogenous nature of Glasswing access. The comparison group — Chinese and Russian tech firms — is chosen because they plausibly face similar vulnerability landscapes but had no access to the model. This is a reasonable but debatable counterfactual. Selection into the treated group (large US tech firms) is not random; these are firms with pre-existing security infrastructure, large codebases, and the resources to integrate a new tool quickly. The paper uses the full CVE universe, which is a strength, but the comparison across geopolitical boundaries introduces confounders (regulatory environment, disclosure norms, state-sponsored hacking exposure) that difference-in-differences can only partially address. The geopolitical asymmetry is the paper's most important finding and its most underexplored. If frontier AI vulnerability scanning becomes standard for US-allied tech firms but unavailable to firms in China, Russia, or the Global South, the security gap between codebases widens structurally. This is not just an academic concern — it means that software infrastructure in non-allied countries becomes the path of least resistance for attackers globally. The paper documents the defender benefit clearly but only gestures at this second-order effect. What makes this paper useful is not the specific numbers — those will shift as models improve and access policies change — but the identification of three distinct channels (defender discovery, researcher displacement, attacker timing) and the empirical separation between them. Future work on AI-in-security will need to address all three channels, and Mosk provides the template. The open question is whether restricted release is a temporary advantage or a permanent asymmetry, and whether the displacement of external researchers weakens the overall security ecosystem even as it strengthens individual firms.
