In mid-August, cryptography professor Matthew Green sparked a viral debate within the cybersecurity community with a provocative thread on X and a longer blog post. Green, who has long scrutinized the tension between government hacking tools for fighting crime and strong encryption for protecting innocent privacy, posed a thought experiment: What if AI makes software bugs so scarce that law enforcement and intelligence agencies can no longer lawfully hack criminals?
“I’m concerned that AI is going to make software much too secure,” Green wrote, warning that as companies patch an unprecedented volume of vulnerabilities, the U.S. government may lose access to the security flaws it relies on to surveil targets.
Law enforcement has long argued that encryption hinders catching criminals and terrorists. The “going dark” concept gained traction in 2014, when then-FBI Director James Comey warned that encryption could prevent authorities from intercepting conversations or accessing device data. Around that time, apps like Signal, WhatsApp, and Apple’s iMessage introduced end-to-end encryption to the masses, making traditional wiretapping of calls and texts nearly impossible. Tech giants like Apple also began encrypting device data by default, complicating access to iPhones protected by strong PINs or passphrases.
Since then, authorities have still managed to catch criminals—often by hacking into their devices—while innocent users have enjoyed robust privacy thanks to encryption. As Green explains, this balance has relied on “an uneasy kind of truce”: instead of building backdoors into devices, governments have invested in hacking tools and spyware to subvert device security.
Now, Green argues, AI is poised to disrupt that truce. As proponents promise and some early data suggests, large language models are becoming more adept at identifying security vulnerabilities at scale. In theory, this could lead to software and systems that are significantly less bug-ridden—and less prone to attacks. The end result, per Green, is that governments might again demand backdoors, making everyone’s devices less secure by design.
A Gold Rush of Bugs
We asked several experts—from privacy and cybersecurity specialists to hackers with experience developing government hacking tools—to weigh in on Green’s argument. Opinions were divided.
Luna Tong, a researcher who previously worked at two prominent firms that search for bugs and develop exploits for government clients, agrees with Green. She describes the current situation as a “gold rush of bugs right now, but it’s a temporary phenomenon—bugs will get scarce again soon.” That scarcity, driven by AI-assisted patching, could fundamentally reshape the landscape of lawful hacking.
via TechCrunch