Key Takeaways

  • Zero-day events on the scale of Log4j and Shellshock used to hit the internet once a year; Cloudflare CTO Dane Knecht says they now occur almost weekly.
  • High schoolers using frontier AI models, dubbed "agent kitties," now uncover critical vulnerabilities that previously required state-sponsored cyber warfare teams.
  • OpenAI co-founder Greg Brockman expects token spend on security to match all software engineering spend by 2027, but Knecht expects that shift to arrive within 18 months.
  • Over 50% of developer time and inference budgets will shift toward automated red teaming and continuous defensive patching instead of shipping product features.

High School Kids Are Finding Zero-Days Every Week

For a decade, security teams calibrated their lives around the rare systemic emergency. A flaw like Log4j or Shellshock would emerge once every twelve months. Cloudflare would call an all-hands crisis, race to patch infrastructure across millions of domains, and protect both enterprise customers and free users as a baseline public good.

That annual cycle is dead. Knecht revealed that these massive vulnerabilities are now surfacing almost every single week.

The people finding them are not elite military intelligence units in Moscow or Beijing. Knecht points out that teenagers running frontier models are finding severe flaws across legacy enterprise software: “Some of these larger vulnerabilities that have come out more recently actually haven't been nation states. They've been high school kids even.” These "agent kitties" use automated AI agents to scan open-source dependencies and corporate attack surfaces continuously. They do not need deep reverse-engineering skills. They give a model an API key, instruct it to probe edge cases, and wait for it to return working exploits.

Token Budgets Are Flipping from Features to Defense

Founders currently view their LLM token spend as an engine for new capabilities. They buy tokens to generate code, draft customer replies, and extract structured data. Knecht warns that this allocation is about to invert.

During a recent conversation on No Priors, OpenAI co-founder Greg Brockman predicted that by 2027, companies will spend as much money on tokens for security as they do on software engineering. Knecht thinks Brockman's timeline is too conservative. He argues the shift will happen across the next 18 months because the threat has moved faster than the defenses.

"There's emergency, right?" Knecht said. “You're going to move forward all your security spend over the next 18 months both from the red team side, which is more the offensive trying to actively try to exploit things, as well as the defensive side.”

When any teenager can deploy an automated offensive agent against your production endpoints, passive perimeter protection fails. Knecht pointed out the double-edged reality: “AI has become the tool that's causing this kind of security apocalypse is also the tool that can help us to solve it faster as well.”

Surviving requires deploying automated defensive models that run continuous red-team loops against your own code. If your company writes software, your models will spend millions of tokens trying to break your authentication flows, fuzz your database queries, and rewrite your dependencies before someone else does. That defensive compute comes directly out of your engineering budget.

The Cost of Ignoring Defensive Inference

Many engineering leaders still treat model spend as a luxury item tied to experimental product bets. They run cost-optimization sprints to trim model calls and demand strict unit economics on user-facing agents. That logic breaks when an unpatched dependency takes your application offline on a Tuesday morning.

Cloudflare recently hired 1,000 interns to accelerate AI experimentation across their systems, testing how models handle production workloads at scale. The signal from their frontline data is unmistakable: codebases that were secure under manual testing cannot withstand automated vulnerability discovery. If you do not allocate significant compute to attack yourself, an agent kitty will do it for free, on their own schedule, with immediate collateral damage to your reputation.

What to Do With This

Review your last month of inference spend and engineering hours tomorrow morning. If less than 15% of your token budget and security review time goes toward automated offensive probing, schedule a four-hour block with your tech lead this week. Stand up an open-source security agent against your staging environment, point it at your API endpoints and pull requests, and let it attempt to generate exploits against your own dependencies.