I believe we’re going to see a lot more security vulnerabilities in the coming years because of AI, and I want to hear if others see it the same way.

Here’s my reasoning:

1. AI-generated code ships faster than it gets reviewed. More people are shipping code they didn’t fully write and don’t fully understand. Even when the code works, subtle issues like weak input validation, hardcoded secrets, and insecure defaults can slip through.

2. AI agents have real access. Models are being connected to email, file systems, databases, browsers, and internal tools. Prompt injection is still an unsolved problem, so a malicious instruction hidden in a webpage or document can potentially make an agent do something its owner never intended.

3. New attack surface. Model APIs, plugins, vector databases, and MCP-style integrations are all new components that many teams are adopting before their security practices have caught up.

4. Supply chain risk. Models sometimes suggest packages that don’t exist, and attackers can register those names with malicious code. Dependencies get pulled in with little scrutiny.

5. Attackers use AI too. Finding bugs, writing phishing messages, and automating reconnaissance all get cheaper and faster for both sides.

To be fair, AI will also help defenders find and fix vulnerabilities faster. But I think the volume of new software and new integrations will outpace that benefit, at least in the short term.

What do you think?