AI-driven bug hunting could revive the encryption 'backdoor' debate

Cryptography professor Matthew Green sparked debate in the cybersecurity community this month with a viral thread and blog post posing a provocative question: What if AI makes bugs so scarce that law enforcement and intelligence agencies can no longer lawfully hack into criminals’ devices? “I’m concerned that AI is going to make software much too secure,” Green wrote, warning that the U.S. government may lose access to the security flaws it uses to surveil targets as companies patch an unprecedented volume of bugs.

The concern echoes the “going dark” debate popularized in 2014 by then-FBI director James Comey, after apps like Signal, WhatsApp, and Apple’s iMessage rolled out end-to-end encryption and device makers began encrypting data by default. Since then, an uneasy truce has held: rather than build backdoors into devices, governments have instead bought hacking tools and spyware to subvert device security directly. Green argues AI is about to break that truce, since large language models are becoming faster and better at finding vulnerabilities at scale — potentially making software dramatically less bug-ridden, and pushing governments to demand backdoors again.

Security researchers are split. Luna Tong, who has worked at two firms that develop exploits for governments, agreed there is currently a temporary surge in AI-discovered bugs that will taper off as software hardens. Paolo Stagno, chief technology officer at zero-day broker Crowdfense, argued no state will give up surveillance capability, and described the current system of governments buying exploits — rather than mandating backdoors — as the most democratic option available, one that may not survive if bugs become too scarce. Others pushed back: Hamid Kashfi, founder of offensive-security firm DarkCell, argued that for every AI-found and reported bug, roughly 20 more go unreported, meaning complex, valuable vulnerabilities aren’t disappearing. Eva Galperin, cybersecurity director at the Electronic Frontier Foundation, said offense currently holds the advantage thanks to AI-assisted bug-hunting and a rise in vulnerabilities from AI-generated software, but cautioned that finding more bugs doesn’t guarantee they get patched faster — or at all — and predicted renewed pressure for backdoors regardless, since authoritarian governments will always want unrestricted surveillance access.

Katie Moussouris, founder and CEO of Luta Security, said bug-free devices remain a distant prospect, and predicted the intelligence community likely has until after the next U.S. presidential election before being materially hampered enough to push seriously for backdoors.

Why it matters

If AI genuinely shrinks the pool of exploitable bugs governments rely on for lawful hacking, the resulting policy fight over backdoors could reshape encryption standards used far beyond law enforcement’s original targets.