The recent wave of AI-driven security research, from Anthropic’s Mythos to emerging agentic security models from OpenAI and others, has reignited an important conversation in application security: What happens when AI can reason deeply enough about code to uncover vulnerabilities that traditional approaches miss, and do so at an unparalleled speed? Is this the end of the practice of finding, preventing and fixing security weaknesses in software, a discipline called AppSec?

AppSec isn’t disappearing, but adapting as AI fundamentally changes the economics and operational reality of software risk. AI-powered analysis doesn’t replace the need for AppSec; it increases it.

Deep AI-driven analysis can uncover complex, long-lived vulnerabilities that evade conventional scanning and manual review, while simultaneously lowering the barrier for attackers to discover and weaponize those same weaknesses faster than ever before.

That changes the game.

AI Is Accelerating Both Software Creation and Risk

The biggest impact is not simply better detection but managing the explosion of operational pressure that follows.

AI is changing both sides of the security equation. It can discover more vulnerabilities faster while also enabling organizations to build substantially more software in less time. If a development team can produce five times as much code as it does today, the security organization must accommodate a comparable increase in components, dependencies, configurations, and potential flaws.

It’s a myth that AI-generated code is free of vulnerabilities. Even if the defect rate per line declines, the overall volume of software can grow so quickly that the absolute number of weaknesses still rises. AI therefore makes automation in AppSec a necessity rather than simply a productivity enhancement.

Organizations already struggle to operationalize today’s backlog of vulnerabilities across applications, dependencies, containers, APIs, and cloud services. AI-driven deep analysis introduces an entirely new layer of findings atop the existing workload, increasing validation requirements, remediation decisions, prioritization pressure, and developer disruption at enterprise scale.

The bottleneck is no longer “Can we find vulnerabilities?” but “Can we realistically operationalize and remediate risk fast enough to matter?”

The Attack Surface Is No Longer Just Code

That challenge becomes even more severe as AI reshapes the application attack surface itself. Modern risk no longer exists only in code. It emerges through the interaction between applications, AI models, prompts, agents, tools, dependencies, and runtime behavior.

Most organizations are not securing a single application but hundreds or thousands of rapidly changing systems operating across both the code and AI layers. The interaction layer between them is where modern AI risk increasingly lives.

Traditional AppSec practices must evolve to address this new reality.

You Can’t Secure What You Can’t See

For starters, few organizations have a complete inventory of AI-enabled applications in use. Tackling increased volume requires that foundation. Even if AI projects are approved and documented, development teams may introduce models, agents, and prompts, embed them in third-party services, or add them to existing applications without a centralized approval process.

If an organization can’t detect an AI component, it can’t protect it. A modern application inventory should identify which applications contain AI components, which models they use, what prompts govern their behavior, which data sources they can reach and which tools or systems they are permitted to invoke.

Conversational “chat” systems get most of the attention but are only a small part of the AI attack surface. AI applications will increasingly contain models and agents that classify documents, retrieve records, generate recommendations, initiate workflows or call other systems without ever interacting with a human. These components can be manipulated through poisoned data, compromised context, badly designed prompts or excessive permissions.

AppSec programs must assess every model and agent involved in an application, including the connections and delegated authority that allow them to act.

AI Security Testing Requires a Different Playbook

Tests must also accommodate the probabilistic nature of AI models. Conventional software is largely deterministic, meaning that the same input under the same conditions should produce the same output.

AI systems don’t behave that way. A model may reject a malicious instruction during one test and comply with a slightly altered version during another. Passing a single security test doesn’t rule out these nuances. Testing must account for variations in wording, context, sequencing, and model behavior. Organizations may need to run repeated adversarial tests and measure the frequency and severity of failures rather than rely on a simple pass-or-fail result.

Continuous discovery helps security teams determine the scale of their exposure, prioritize testing, and enforce consistent policies. That is the real shift the market is experiencing.

The Real Challenge Is Operationalizing Risk

The future of AppSec won't be won by depth of analysis alone. It will be won by resilient operationalization, the ability to continuously and rapidly identify risk, prioritize what matters, automate remediation, enforce governance, and reduce exposure across massive software ecosystems without breaking development velocity.

Deep AI analysis is incredibly valuable for targeted investigations, critical audits, and uncovering sophisticated vulnerabilities. But enterprises also need scalable workflows around those discoveries. These encompass continuous visibility, developer-native remediation, prioritization, policy enforcement, runtime protections, and automation that can operate at enterprise speed.

Developers cannot wait hours for every pull request analysis cycle. Security teams cannot spend thousands of dollars on deep code analysis every time code changes. And organizations cannot rely on point-in-time assessments when modern software and AI systems evolve continuously.

That is why the future is not “AI reasoning versus AppSec platforms,” but about AI reasoning embedded into scalable security operations.

From Vulnerability Discovery to Continuous Risk Reduction

I see the rise of Mythos and similar technologies as validation of where the market is heading, not as a replacement for broader AppSec programs. AI will absolutely improve vulnerability discovery, but discovery alone has never been the hardest problem in AppSec.

The hardest problem is helping organizations continuously reduce risk faster than new risk is introduced.

That requires connecting security across:

• the code layer
• the AI layer
• and the interaction layer between them

It requires developer-native remediation, policy and governance, runtime protections, prioritization, automation, and operational workflows that security teams can realistically sustain at enterprise scale.

Red Teaming Can’t Remain a Periodic Exercise

Traditional red teaming is often a scheduled exercise that tests an application every few months. That approach won’t work with the demands of a software landscape that changes daily and AI systems whose prompts, models, data sources, and tool connections can be modified continuously.

Adversarial testing must become part of the development process. When a new AI component is introduced or an existing one changes, organizations should test whether it can be manipulated to expose data, disregard instructions, generate prohibited content or take unauthorized actions before the change reaches production.

The range of remediation options must also expand. Solutions could involve hardening a system prompt, restricting access to data, narrowing an agent’s permissions, adding validation around tool calls or changing how retrieved context is processed. Red teaming should no longer be treated solely as a periodic audit but as a continuous development control.

AppSec’s Future Is Bigger, Not Smaller

The organizations that succeed in the next era of software security will not simply adopt deeper analysis.

They will build resilient systems capable of operationalizing security across increasingly autonomous and AI-driven development environments.

AI-powered security analysis is an important signal of where the market is going. But it is only one piece of what modern AppSec now requires.