How AI could make it harder for governments to use hacking tools

Earlier in August, cryptography professor Matthew Green wrote a controversial thread on X and a longer blog post that went viral within the cybersecurity community.

Green, who has long been a close observer of the debate around the use of hacking tools by governments to fight crime and the need for strong encryption to protect the privacy of innocent people, posited a provocative thought: What if AI makes bugs so scarce that law enforcement and intelligence agencies are unable to lawfully hack criminals anymore?

“I’m concerned that AI is going to make software much too secure,” Green wrote, warning that the U.S. government may lose access to security flaws to hack into targets they need to surveil as companies patch an unprecedented volume of bugs.

Law enforcement have long claimed that encryption made it difficult to catch criminals and terrorists. The concept of “going dark” was popularized in 2014 at a time when then-FBI director James Comey warned that encryption could hamper authorities from being able to listen in on conversations or access data on devices.

Around this time, apps like Signal, WhatsApp, and Apple’s iMessage rolled out end-to-end encryption to the masses, making traditional real-time wiretapping of calls and text messages almost impossible. Tech giants like Apple also began making data on their devices encrypted by default , making it harder to break into iPhones protected by a strong PIN code or passphrase.

Since then, authorities have still been able to catch criminals — including by hacking into their devices — and innocent people have been able to enjoy a good level of privacy thanks to encryption. In part, as Green explains, that is because of “an uneasy kind of truce.” That is, instead of incorporating backdoors into devices to help authorities get the data, governments have instead invested money into buying hacking tools and spyware that can subvert the security of devices and their owners.

For Green, that truce is about to be disrupted by AI, because, as proponents promise and some early data suggests , LLMs are becoming better and faster at finding security vulnerabilities at scale. That, in theory, suggests we will get to a point where companies can make their software and systems significantly less bug-ridden — and prone to attacks.

The end result, per Green, is that governments could ask for backdoors again, making everyone’s devices less secure by design.

We asked several people to chime in on Green’s argument, from privacy and cybersecurity experts to hackers who have experience developing hacking tools for governments. Some agree with Green, some disagree, and some see it both ways.