APBSC 05 · Hypothesis

AI build–attack asymmetry

If building gets cheaper faster than securing does, weak targets multiply; if AI also lowers the cost of finding them, the two sides drift apart.

2026-09-21 · v0.1 · Internal research draft v0.1 · full text not yet public

C_build ↓↓ ∧ N_low-security ↑ ∧ C_recon ↓

The argument

AI coding lowers the cost of building a working application far more than it lowers the cost of building a secure one. The paper reviews 2026 evidence as its sources report it: a controlled code-generation benchmark in which about 44% of tasks produced known weaknesses, and a scan of 1,119 AI-built web applications in which 31.1% had at least one critical or high finding — a self-submitted, non-random sample by the source's own account. Neither is an Internet-wide rate.

It refuses to overstate the attack side. In a 2026 multi-stage exploitation benchmark, frontier models still showed clear limits, and none broke through its defenses. Current AI is not a universal autonomous attacker.

The hypothesis is therefore narrow: cheap building, more low-maturity targets and cheaper reconnaissance, triage and exploit adaptation may together enlarge the low-hanging-fruit attack surface. Whether defensive automation and secure-by-default platforms outpace it is exactly what is not yet known.

Key ideas

Functional success and secure success are different finish lines.
The novice security gap is mediated by expertise and by platform defaults.
An AI attacker does not need to be a universal hacker to change the economics of weak targets.

Propositions it carries

HHypothesis
AI-assisted building grows the population of low-maturity targets faster than defensive automation shrinks it.
05

What it does not claim

The Internet is full of easy targets.
AI can break mature systems on its own.
The cited benchmark figures are population rates.