It has been a bloody week in IT security - a massive flaw in PHP with remote code execution to any php-served resource at the http level forced much of the internet down for security updates. And this action was not alone - in the same week major flaws in the SSL ecosystem (a bad but trusted certificate provider) and popular development tools were published more or less at the same time. Freak accident, right? Sadly, no. Just another week. If you take a look at the CVE vulnerability database, what you see is a curve that's a a fairly standard exponential - yes there was a change in the growth rate when the AI agents started functioning properly last december, but that's otherwise it.

The implication of that - if you're not used to looking at exponentials - is that what looks like a radical break in seriousness is not that at all - it's just a completely standard exponential curve. If you went back in time and looked at a different time window the recent past at that time which now looks like a flat line at the bottom - would have also looked like a sudden radical explosion of risk.

There's simply no reason to believe this will stop. Quite the contrary - what we're seeing now is even based on the risks of software already produced - i.e. mostly made by people. With agents we're now producing so much more software - and that'll have security flaws also - further accelerating the curve.

It's not just an explosion of new layers. It is the rapid erosion of the old layers

Looking at this made me think. It's not just that we're done programming. Agentic AI is attacking all the code we already wrote at a furious pace - which will probably lead to all of this code being replaced sooner than you would think; simply because whatever we made was not safe from the risks AI are able to find. So even the foundations - man made - we all lean on are likely to be fully replaced at quite a rapid pace, meaning an end to software people ever looked at, much sooner than you might think.

The erosion and replacement with AI-vetted, AI-generated code will very likely be more complete and much faster than you would think.

Timing the takeoff

Take another view at the graphic at the top of this post. What's also interesting about it is that the real change in the curve can be very clearly made out - a model shift starting in december 2025 - which is when the coding agents finally started to really work. The code-assistance we've been getting for years at this point made barely a dent in this - but agents running autonomously for extended periods of time are just a completely different game.