Will AI Vulnerability Discovery Make Security Engineers Obsolete? A 2026 Practical Analysis

Introduction: AI Vulnerability Discovery — Threat or Tool?

"AI can already find vulnerabilities now — are security engineers going to lose their jobs?" This is the question posed by Bilibili creator "我要老师" (Teacher Wo) at the start of his video, and it's one of the most anxiety-inducing topics in the security community over the past few years. His answer is direct: to judge AI's impact, you must first understand where AI actually stands in the cybersecurity industry — is it theory, early-stage application, or large-scale deployment?

In this tutorial, the creator demonstrates AI's current capability boundaries through three scenarios: AI vulnerability discovery, code auditing, and CTF problem-solving. This article is based on the video content and combines it with industry observations to break down AI's real impact on security engineers' careers.

The Real Application Stage of AI in Security

The creator emphasizes that before discussing "job loss," one must answer a prerequisite question: where exactly is AI in the cybersecurity industry today?

Based on public information and industry practice, AI's application in security shows clear stratification:

• Early-stage applications are widespread: In tasks like log analysis, alert noise reduction, and vulnerability report summary generation, AI-assisted tools are already fairly common.
• Mid-stage applications are being explored: AI-assisted code auditing and automated vulnerability discovery (such as LLM-based static analysis) are in early deployment stages, with results varying by scenario.
• Large-scale full automation has not yet arrived: Fully autonomous AI vulnerability discovery and exploit chain construction still face obstacles in accuracy, interpretability, and legal compliance.

The creator explicitly states in the video that he has been researching this direction for the past three years, and that AI currently serves more as "augmentation" than "replacement."

Static Application Security Testing (SAST) and LLM-based Code Auditing

Traditional SAST tools rely on predefined rules (such as taint analysis and pattern matching) to scan source code. They excel at finding known vulnerability types but have high false-positive rates for context-sensitive logic flaws. LLM-based code auditing is different: it takes code snippets or entire repositories as input and uses the model's understanding of programming semantics to directly reason about potential defects. Its advantage lies in handling natural language comments, cross-function call chains, and framework conventions; its disadvantages include being limited by context windows, potentially producing "hallucinated" false positives, and difficulty ensuring reproducible results. The industry currently mostly adopts hybrid workflows like "LLM initial screening + human review" or "SAST alerts + LLM noise reduction," rather than letting models independently issue audit conclusions.

Practical Scenario 1: AI Vulnerability Discovery and Code Auditing

The video demonstrates AI's actual performance in vulnerability discovery and code auditing. The creator asks AI to analyze code snippets and attempt to find potential vulnerabilities, with results showing typical characteristics:

Advantages: AI can quickly scan large amounts of code, identify common vulnerability patterns (such as typical SQL injection and XSS patterns), and provide remediation suggestions. For beginners, this lowers the entry barrier.

Limitations: AI has limited ability to identify business logic vulnerabilities and defects with complex contextual dependencies, and may produce false positives. In the demonstration, the creator does not claim that AI can fully replace manual auditing, but emphasizes its supplementary value.

The takeaway from this scenario: security engineers need to learn to "audit with AI," not "be audited by AI."

Why Business Logic Vulnerabilities Are Hard for AI to Identify

Business logic vulnerabilities (such as unauthorized access, payment amount tampering, and process bypasses) do not stem from syntax-level coding errors but from "inconsistencies between code implementation and business expectations." To discover such issues, auditors must understand business rules, role permission models, and the meaning of data flows in real-world scenarios — information that is often not in the code but in requirements documents, product designs, and industry conventions. LLMs lack prior knowledge of specific business contexts and struggle to build cross-module state machine reasoning, making them prone to missed detections. Additionally, logic vulnerabilities typically have no fixed code patterns to match, in stark contrast to vulnerabilities like SQL injection and XSS that have typical signatures.

Practical Scenario 2: AI Solving CTF Challenges

CTF (Capture The Flag) is the touchstone of security skills. The creator demonstrates the process of AI solving CTF challenges.

From the demonstration, AI performs relatively well in the following types of challenges:

• Simple reverse engineering or cryptography challenges requiring pattern matching
• Web challenges with known vulnerability types
• Miscellaneous challenges requiring quick documentation lookup

However, AI still struggles with challenges requiring multi-step reasoning and creative exploit chain construction. Through this segment, the creator aims to show: AI is a problem-solving assistant, not a problem-solving replacement.

Capability Differences Between CTF and Real-World Vulnerability Discovery

CTF competition challenges are typically designed to be self-contained, clearly bounded, with a single expected solution, and most correspond to some known vulnerability type or technique. This structure happens to align with what LLMs excel at: pattern matching and knowledge retrieval. Real penetration testing, however, faces unknown architectures, custom code, and dynamically changing defenses; attack surfaces must be actively enumerated, and exploit chains must be gradually adjusted based on live feedback. Therefore, good AI performance in CTF does not mean it possesses real-world vulnerability discovery capability; CTF scores are better suited as a metric of a model's "security knowledge coverage" rather than proof of "autonomous attack capability."

Impact on Security Engineers' Careers and Recommendations

Back to the two questions from the opening:

Q1: Will all security engineers lose their jobs? The creator's answer is no. AI eliminates repetitive, pattern-based tasks, not engineers themselves. What should truly be concerning is practitioners who "only know how to use tools without understanding principles."

Q2: Can I skip learning security techniques and only learn AI vulnerability discovery? The video's position is clear: no. The prerequisite for AI vulnerability discovery is that the user has security fundamentals and can judge whether AI output is correct. Those who don't understand vulnerability principles cannot effectively direct AI or verify results.

The creator's recommended learning path: first solidify foundations in web security and code auditing, then integrate AI as an efficiency tool into your workflow.

Conclusion: AI Is a Leverage, Not a Replacement

The core value of this Bilibili tutorial lies in using practical demonstrations to break both extreme narratives — "AI is omnipotent" and "AI is a threat." AI shows supplementary capabilities in vulnerability discovery, code auditing, and CTF problem-solving, but is still far from becoming a fully automated security engineer. For practitioners, embracing AI tools while deepening security fundamentals is the prudent strategy for adapting to change.

One-line Summary

AI remains an auxiliary tool in security; security engineers won't lose their jobs but need to solidify fundamentals.

Paragraph Summary

Based on Bilibili creator "我要老师"'s tutorial, this article explores AI's impact on security engineers' careers. The author notes that AI in cybersecurity is at an early-to-mid application stage: log analysis and alert noise reduction are widespread, AI-assisted code auditing and vulnerability discovery are being explored, and full automation has not yet arrived. Through three practical scenarios — AI vulnerability discovery, code auditing, and CTF problem-solving — the article demonstrates AI's strengths (quickly identifying common vulnerability patterns, lowering entry barriers) and limitations (business logic vulnerabilities, complex context, and multi-step reasoning remain weak spots). The conclusion: AI eliminates repetitive tasks, not engineers themselves; practitioners who don't understand principles are at higher risk. The recommended learning path is to first solidify web security and code auditing foundations, then integrate AI as an efficiency tool into workflows.