> Moving past autonomous exploitation to machine-speed security

Frontier AI advancements have created a world where exploitation outpaces defense. The average enterprise takes 32 to 43 days to patch, but the mean time to exploit a vulnerability is 10 hours. This asymmetry creates questions around how enterprises can trust autonomous AI to operate ubiquitously across their environments. As I mentioned on the TechCrunch Disrupt stage last week, security at machine speed means AI accelerates the fix as quickly as it does the find. Below is an expanded take of that discussion. The asymmetry between detection and remediation The asymmetry between attackers and defenders exacerbates the patching problem. Traditional security models triage by severity using manual processes, which creates weeks- and months-long backlogs. But advanced models allow attackers to chain together low- and medium-severity flaws — which fly under the radar by design — to create a high-severity issue. For example, a cross-site scripting flaw, a session cookie hijack and a database leak are separately registered as medium-severity incidents. As a chained exploit, the cross-site script gives an attacker an entry point into the browser they use to hijack the session cookie, allowing authentication as a user, which gives them database access with full read of production data.  The prompting quandary The tension in machine speed security is that detection is devastatingly accurate, but patching is still catching up. Tests we ran on CyberGym produced a 95 percent precision rate for discovering complex, sequence-of-events bugs. The discovery muscle works. But more than 98 percent of the time, frontier models refuse to execute remediation prompts because their built-in guardrails miscategorize 76-99 percent of direct prompt code involving vulnerabilities as false positives. When they do attempt patches, 55 percent fix the primary issue but miss a secondary point and 40 percent of patches break production code. Prompting alone won’t fix the asymmetry because detection rates are high but remediation precision is low. Fixing the engineering gap Prompting with advanced models isn’t enough. The answer is an integrated system that brings together multi-agent orchestration, context injection, sandbox validation and iterative repair. Powering the accuracy of this harness are insights from the context graph, sandbox infrastructure, validation pipeline and experience implementing security primitives. Three advancements to cross the chasm Engineering advancement requires technology to move beyond three limitations. The system needs to go beyond humans in the loop to working autonomously and continuously. It cannot simply explain triage in plain English – it must produce durable issues with evidence-backed solutions. It cannot be a Wizard of Oz harness backed by a frontier model. The way forward is a multi-agent system with identity and access management for every action and session and Cedar enforcement over fine-grained access policies. The system compresses signals into actions governed by IAM and Cedar, not simply raw model calls.  5 ingredients for a robust multi-agent system Five design choices create a robust multi-agent system Cyber-enabled models. The first component is using multiple cyber-enabled models optimized for vulnerability discovery. 5-stage harness. Next, build a 5-stage harness that includes reconnaissance, threat modeling, hunter, validation and remediation. Zero-egress sandbox. Third, ensure the sandbox is a zero-egress microVM with no internet access, no IAM role and a start-fresh invocation. 2-layer validation. Validate by running L1 static analysis and L2 dynamic security testing inside the sandbox. Require proof of trigger before closing. Rich context. Finally, the accuracy multiplier comes from feeding the system infrastructure, application and business-specific context. This system creates a continuous loop that discovers, prioritizes, validates and remediates in a way that produces the same answer every time in a provable manner that scales to thousands of repositories. 3 agents, modeled on security roles The prioritization agent thinks like a threat intel analyst. It scours the context graph, scores proximity to your crown jewels, runs classifications and looks at business impact. The validation agent thinks like a red team operator. It maps attack paths, assesses blast radius, checks for compensating controls to provide a three-value answer: exploitable, inconclusive, or not exploitable. The remediation agent thinks like a security engineer. It patches from a proven exploit. It fixes a pattern, not a single line of code. It hits every point. It delivers a test suite in the sandbox along with the pull request.  These agents work together in a shared state using durable records. Each one performs its scoped role and writes back. The context moat to power system accuracy From the CyberGym tests, context improved LLM accuracy. Generic LLM accuracy sat around 65 percent. Infrastructure context brought that up to 90 percent. Adding business context took accuracy up to 95 percent. A machine speed security system requires strong context rooted in infrastructure-level security. This exists in five pillars: Formally verify every path to determine network reachability. Leverage automated reasoning over IAM policies that mathematically prove whether a policy grants unintended access. Block by default public access to your cloud. Real-time continuous inventory of every resource and configuration change. Mathematically prove security correctness deployed at scale. So how do you trust this autonomous system? Every call goes through a four-gate authorization chain. The first gate is a policy engine with two layers: IAM scoping to guard against reaching outside the boundaries you’ve set and Cedar to enforce fine-grained tool access for what actions agents are permitted to take on which resources under what conditions. This imposes deterministic guardrails for agent actions without looping in an LLM for these authorization decisions. The second gate is input validation delivered by schema checks and account binding. The third gate is a fail-closed audit where every action is logged before execution, and nothing dispatches if the audit fails. The fourth gate is the credential broker scoped to one action, one resource with a 15-minute time to live (TTL). As mentioned earlier, the sandbox is zero-egress with no internet connectivity or service endpoints. Memory is destroyed after each task. If something goes wrong inside the sandbox, the issue remains isolated there. We layer on graduated autonomy to handle the spectrum of risk. Guardrail tolerance could look like: 80 percent autonomous for removing unused permissions 60 percent autonomous for tightening security groups 20 percent autonomy for modifying IAM roles Zero autonomy for deleting resources – only humans can take this action Finally, add three-value output transparency. Every decision cites evidence with a confidence score. LLM judgment is separated from deterministic math. Full W3C tracing with 90-day retention. These elements create a governed system for the LLM with durable records instead of chats and explicit state instead of prompts. Delivering machine-speed security Anyone can wrap a model in a harness and build a user interface. But that’s a commodity play destined for higher rates of inaccuracies and incomplete remediations. A robust system needs infrastructure context from where your workloads live, formal verification that produces traceable results, and a governed control plane. Detection is solved. Every commercial scanning tool can find security events. The hard part is building a trustworthy autonomous system that understands what a problem means in your environment and then helps move the organization toward the right response.