If we have AGI capable of finding vulnerabilities, then we can just ask the AGI to design a system so secure that even the AGI cannot find any vulnerabilities.

Writing programs to automatically find bugs is a pursuit almost as old as compilers, and the models used to do that in modern static/symbolic analysis tools are much more sophisticated than an LLM's next-token generator.

They will revolutionize the ability to find and fix vulnerabilities.

Threat actors can already afford expensive security researchers today. It removes some of the asymmetry.

i worry more about GPT-assisted social engineering.