The vulnerability beat has spent years treating AI as a topic rather than a tool. This week's logged stories make that framing obsolete. Across a vendor zero-day exploited in the wild since late August, a comparative look at AI versus human penetration testing, and the first LLM-assisted patch accepted into the Linux kernel, the same thread runs: AI is now embedded at both ends of the vulnerability lifecycle, in the discovery and exploitation of flaws on one side and in the testing and remediation of them on the other. The security industry is not debating whether to adopt it anymore; it is arguing about what it can be trusted to do, and where a human still has to stand.
A Zero-Day That Reframes the Timeline
BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support product that has been exploited in zero-day attacks since late August, as BleepingComputer reported. The detail that matters is not the flaw itself but the calendar. A remote support tool sits inside the perimeter of a large share of US enterprises, and it is precisely the kind of software that security teams assume is hardened because it is the thing they use to reach everything else. Attackers holding a working exploit against that class of product for roughly six weeks before a patch changes the math for every defender downstream. Vendors on the vulnerability beat have spent a decade compressing the gap between disclosure and patch; this case is a reminder that the gap between exploitation and disclosure is the one that actually gets people breached.
That is the backdrop against which everything else in this week's material should be read. The same techniques that let a vendor's customers get caught flat-footed are now being productized on the defensive side, and the defensive side is where the money and the argument are headed.
AI Pentesting Finds More, Understands Less
Intruder's comparison of AI penetration testing with human testers, covered by BleepingComputer, lands on a nuanced conclusion: AI agents can surface vulnerabilities that human testers miss, but they fall short on consistency, risk assessment, and business context. That combination is more interesting than either half. The coverage gaps that human testers leave behind are exactly what automated agents are good at closing, since a machine does not get bored, does not skip the twentieth endpoint, and does not tire at hour six of a scoped engagement.
But finding a flaw and knowing what it means are different problems. Risk assessment requires knowing which system holds regulated data and which is a lab box; business context requires knowing that a particular service is customer-facing and cannot be taken offline for a fix. Neither is a property of the code. An agent that cannot distinguish the two will produce longer lists, and longer lists are not the same as better security. For US companies buying testing capacity, the practical implication is that AI pentesting changes the economics of coverage while leaving the hardest judgment calls where they were: with a person who understands the business.
