Why would it obviously give attackers the upper hand? If we accept the premise that AI helps find vulns more efficiently, shouldn’t this be at least equally helpful in securing against attacks and make that increasingly efficient?
It won't do that for free, companies (and open source maintainers) will have to pay for the tokens used finding vulnerabilities in their own software. That increases the cost of releasing the same product/feature/amount of code vs what it was before.
everything you build potentially increases the surface area of attack. If the benefit of building it is zero or negative then all you've done is increase your risk profile.
