Cyber’s attack–repair race: what closes the loop after a finding?

Research brief completed 15 October 2026. Question: does AI help defenders find and close vulnerabilities before similarly capable attackers exploit them? Good answer follows flaw discovery → independent validation → functionality-preserving patch → actual deployment → a different subsequent exploit, counting reviewer hours, compute, delay and comparable human work. Existing resource/visibility and July incident notes emphasize attacker access, while spotting versus stopping concerns agent actions rather than fixing known code.

Four subquestions and primary-source shortlist

1. Real defensive use? The Government Cyber Coordination Centre’s 12 June technical case study describes AI-aided scanning of public government code and human-checked critical fixes. The 12 October ministerial statement combines two pilots, saying they found and addressed 1,352 vulnerabilities in 548 repositories in 18 departments. The June 407 findings include already known/compensated cases. The combined political claim is not 1,352 independently validated patches or avoided intrusions.
2. Which side wins on the same flaw? Heldt et al., 5 October preprint pair AI attack and patch tasks: repair scores lead in two nonpublic environments, attack in three. On 209 disclosed flaws two model/harness combinations favor attack; one leans repair with an uncertain confidence interval. Results vary by software and harness, not a universal defender or attacker advantage. Public and private task criteria differ and have no field-human baseline.
3. Does fixing the first exploit suffice? In the paper another attack succeeds in 92 of 524 dependent test intervals after the first is blocked; intervals include intermediate repairs, not a field patched-vulnerability rate. Attackers win 115 of 117 defender-first code-change rounds by a criterion that includes broken or functionality-damaging patches, not 115 proven bypasses. A government report of critical fixes is encouraging, but it is not an independent subsequent-attack audit.
4. Cost and deployment gate? June’s £13,000 covers model tokens for the month, not expert review, static scanners and patching. No matched scanner-and-human-only workload, true review hours, release lag, or production exploitation denominator. A question tabled in Parliament on 14 October, due 19 October, asks the two pilots’ full cost and how many vulnerabilities were actually remediated. Check the answer before making a stronger claim; it had not arrived by this 15 October run.

Synthesis: a real government team has both source access and patch authority, so “defenders cannot use AI” is false. Yet the lab test makes clear that a patch can fail functional validation or a different exploit. A credible skeptical alternative to runaway cyber harm is equal defender model access and repair rights; the gap may be scarce review labor and time-to-deploy, not just GPU costs. The UK NCSC’s May 2025 forecast anticipated uneven defender adoption but predates the 2026 live incidents, so do not cite it as evidence those were contained.

Search passes covered original operator workflows, nonpublic paired studies, matched human/budget evidence and the October follow-up. Found no independent case-level patch register or government human-only control. Discriminating design: equally scoped repositories randomly assigned to AI-augmented and scanner-and-human teams, independently verified novel exploits, all-in labor/token/review cost, signed production deployment timestamps, and withheld subsequent-exploit tests. Feed: June GC3 case study is an authored short weekday counterpoint; Heldt’s original is a weekend hold if Dru reacts. Check Parliament’s actual-remediation question on/after 19 October rather than re-running the same broad search tomorrow.