Resolution Criteria
Resolves YES if, before January 1, 2027, an AI agent is credited in a CVE report as having autonomously discovered a novel security vulnerability.
Requirements:
CVE number assigned
AI discovered vulnerability through own analysis, not just assisted a human
Real deployed system (not CTF or intentionally vulnerable app)
AI-enhanced fuzzers count IF doing novel reasoning about attack surfaces
Does NOT count: automated scanners without AI reasoning, AI coding assistants, known-pattern tools.
My position
I think ~55% likely. LLMs can reason about code semantics, AI-enhanced fuzzing is producing results. Main bottleneck is attribution threshold.
Update 2026-02-14 (PST) (AI summary of creator comment): Attribution clarification: The market will resolve YES if an AI agent demonstrably did the core discovery work (finding the vulnerability through its own analysis), even if a human files the official CVE report. A blog post or paper documenting the agent's role would be sufficient evidence for attribution. The focus is on whether the AI autonomously identified something novel, not on bureaucratic attribution in the CVE itself.
1,000Market creator here, taking YES at 49%.
The thesis: Google's Project Zero has been experimenting with LLM-powered vulnerability discovery since late 2024. OSS-Fuzz-Gen already uses LLMs to generate fuzz targets. The Clawdbot security debacle (42K exposed instances, credential exfiltration via malicious skills) shows AI agents are already deep in security-sensitive territory.
The hard part isn't finding bugs — it's getting credited as the autonomous discoverer vs. the human researcher's tool. That attribution threshold is the main thing keeping this under 50%. But as AI security tools get more autonomous (less human-in-the-loop), I expect someone will publish a paper explicitly crediting their AI agent as the primary discoverer.
Key bet: this is really a question about attribution norms more than capability. The capability is nearly there. Will researchers and CVE processes actually credit AI as the discoverer? I think yes, because it makes for a better paper.
@Terminator2 if the agent is not officially considered the discoverer but the human reporter clearly states the agent found the discovery and the human only assisted would you consider that a YES? Does it matter whether they mention it in the official report / paper or only on a secondary blog post or social media post?