AI・テクノロジー
The Day the Security Wall Disappeared — Vulnerabilities Found by AI
機械翻訳 / Machine-translated
❤️ 0
🔖 0
⚡ 0
機械翻訳 / Machine-translated
In April 2026, within just seven days, the two AI giants OpenAI and Anthropic announced their respective "cybersecurity-specialized AIs" in rapid succession. A domain once accessible only to security engineers with deep expertise — discovering and fixing software vulnerabilities — is now being transformed by AI into a technology within anyone's reach.
"I always dreamed of working in security, but it felt too specialized and I gave up." For people who felt that way, the announcements this April sounded like the opening of a new door.
On April 8, Anthropic announced an AI model called "Claude Mythos" that automatically discovers and fixes software vulnerabilities. It scored 83.1% on CyberGym, a benchmark that measures the ability to autonomously detect real-world vulnerabilities — a significant improvement from the previous model's 66.6%, bringing it close to the accuracy of human security engineers.
On April 14, OpenAI followed suit, releasing a model called "GPT-5.4-Cyber," likewise specializing in vulnerability discovery and remediation. In contrast to Anthropic, OpenAI adopted an approach that allows thousands of individual developers and hundreds of teams to access the system after identity verification.
The two companies differ in their approach. Anthropic chose to limit access to 12 carefully selected partner organizations plus 40 additional groups, minimizing the risk of misuse. OpenAI, on the other hand, took a strategy of broadly opening access to the "defensive side." This difference in strategy symbolizes a future where individuals can access security technology.
Until now, software security assessment was the domain of professionals holding certifications like CISSP or CEH, or hackers honed through CTF (Capture The Flag) competitions. Finding vulnerabilities required deep knowledge of memory management, network protocols, and cryptographic theory.
But with the advent of AI, that barrier is rapidly lowering. Ask ChatGPT or Claude to "check this code for vulnerabilities" and it will point out typical problems like SQL injection, XSS (cross-site scripting), and authentication flaws. The new models released in April 2026 go even further, reaching a level where they can "autonomously search for vulnerabilities and present remediation proposals."
This marks the moment when security — once a specialized field — becomes democratized.
Many people once aspired to become security engineers but gave up, thinking "I'm not good at math," "I don't have a computer science degree," or "self-study has its limits." But with AI now serving as an assistant at your side, those barriers are far lower than you might imagine.
For example, if you want to run a "security assessment" on a web app or mobile app you've developed on your own — traditionally, you'd have had to pay hundreds of thousands to millions of yen to an external security firm. But with ChatGPT Plus (USD $20/month) or Claude Pro (USD $30/month), you can perform basic vulnerability checks through code review features. It's not perfect, but it's more than powerful enough as a first step.
At HAIIA certification, acquiring security skills using AI is also being explored as part of a new curriculum. Rather than aiming to become a specialist, the goal is to become "someone who can protect security in collaboration with AI." That is the realistic option in 2026.
So what should you start with, concretely?
1. First, have your existing code reviewed
Paste code you've written in Python, JavaScript, Go, or other languages into ChatGPT or Claude and ask, "What security issues does this have?" You'll receive genuinely useful feedback even with the free tier.
2. Learn the OWASP Top 10
Read the "Top 10 Most Common Vulnerabilities" published by OWASP (Open Web Application Security Project). Since AI provides advice grounded in this knowledge, understanding the basics will raise the quality of your conversations.
3. Practice on a small project
Incorporate an AI assistant into your personal side projects or hobby development to make security checks a habit. Ask AI for a code review once a week — and within a few months, you'll naturally be able to design with security in mind.
Self-realization — one of HAIIA's three pillars — refers to exactly this: "taking another shot at a field you once gave up on, together with AI."
No, not yet fully equivalent. As of April 2026, Anthropic's Claude Mythos achieves 83.1% accuracy on the CyberGym benchmark, which means it can find "most basic vulnerabilities." Complex combination attacks or vulnerabilities stemming from business logic still require human experts. However, for individual developers and small-to-medium businesses, it is more than valuable as an initial screening tool.
There is. That's why Anthropic opted for limited access and OpenAI also made identity verification mandatory. However, if the speed at which the defensive side (developers, companies, security teams) uses AI to protect their code increases, there is a chance it can gain an advantage over attackers. Leveraging AI for defense will be the key going forward.
Yes. Basic security checks are possible even with the free versions of ChatGPT or Claude. Simply asking "Are there any vulnerabilities in this code?" will return specific findings and suggested fixes. If you don't understand the technical terms, just follow up with "Please explain that more simply." AI supports your learning through conversation.
The "sanctuary for specialists only" that security once was is being opened up by AI. The announcements of April 2026 may not simply be a technological advance — they may become the catalyst that sets abandoned dreams in motion.
Your first step toward protecting your code can begin today.
Joining the community to find others learning security alongside AI is also a new step forward.
This article is reprinted from HAIIA Notes.