Tech Radar — When AI finds the bugs faster than you can fix them

The pattern this week is a shift in the cost of discovery. AI now finds vulnerabilities, generates reports and spins up paid infrastructure faster than organizations can triage, fix or pay for them. The bottleneck has moved from finding problems to absorbing them — and that is a capacity and governance problem, not a tooling one.

Epic pauses most product development to fix AI-found security flaws

Epic, whose MyChart software sits in front of more than 320 million patient records, has paused most product development for roughly six weeks after a deployment of Anthropic's Mythos security model surfaced flaws that could expose patient data (techcrunch.com). Its CSO said some customer configurations could allow outsiders to access records without the intrusion appearing in logs.

Impact for companies: a vendor of critical software publicly traded six weeks of roadmap for security debt. Expect boards and customers to ask why you have not done the same review.

Risks and opportunities: the risk is that attackers have access to the same class of models. The opportunity is to run that scan on your own terms, before someone else does.

My take: the most important detail is not the model, it is "no record in the logs." A vulnerability you can find but cannot detect being exploited is a governance failure. Pausing feature work is expensive, but far cheaper than an incident in a regulated domain. Plan the scan, budget the remediation capacity up front, and do not start one without the other.

Google freezes its open source bug bounty under a flood of AI submissions

Google paused its Open Source Software Vulnerability Rewards Program as of October 1, promising an update in Q1 2027, citing a "significant rise" in automated submissions, the vast majority invalid (techcrunch.com). Maintainers were overwhelmed by reports containing hallucinations.

Impact for companies: any intake channel that pays or rewards volume — bug bounties, support queues, vendor questionnaires — is now cheap to flood.

Risks and opportunities: the risk is that real findings drown in noise and your team burns out triaging. The opportunity is to require reproducible evidence — a failing test, a proof of concept — as the price of entry.

My take: read this next to the Epic story. The same technology produces both a six-week fix list and a program shutdown. The difference is not the model, it is whether the output arrives with verification attached. Make "show me the failing test" a hard requirement for any AI-generated finding, internal or external.

Gemini 4 Argon is built for defensive security first

Google launched Gemini 4 Argon, rolled out first to selected cyber partners through its Fairwind Program, and says it can "autonomously find, validate, and patch" critical vulnerabilities (techcrunch.com). Google staff already use it for debugging and codebase migrations, and the company claims it leads OpenAI's GPT-6 Astra and Anthropic's models on Vals' index.

Impact for companies: security capability is becoming the headline differentiator between frontier labs, and gated access is the distribution model.

Risks and opportunities: the risk is buying on vendor benchmarks. The opportunity is codebase migrations — a measurable, high-cost workload where a strong model pays back quickly.

My take: I discount vendor leaderboards by default. What matters is the word "validate": a model that proposes a patch with a reproducing test is a productivity tool; one that only proposes patches is a review burden. Evaluate on a migration from your own backlog, with your own tests as the referee.

Denmark's citizen register stolen through a partner's legitimate access

Denmark confirmed that its Central Person Register — records for about 11 million people, including national ID numbers — was breached in September and discovered on October 2 (techcrunch.com). The attackers abused a Danish company's lawful access to search the system; around 8 million people are affected.

Impact for companies: the attack vector was not a perimeter breach, it was a legitimate integration used beyond its intent.

Risks and opportunities: every partner API key, B2B integration and service account with broad read access is the same exposure. The opportunity is cheap: rate limits, query-pattern monitoring and least-privilege scopes on third-party access.

My take: "lawful access" with no anomaly detection is just a slower front door. Most companies I have worked with can list their partner integrations but cannot say what normal query volume looks like for each one. Baseline it this quarter. Under LGPD and GDPR, the liability is yours, not the partner's.

Hard spend caps arrive on AWS and Google Cloud

Simon Willison argues that coding agents make it trivial to deploy services that bill by usage, and that hard budget caps — cut off and return errors, not send a warning email — must become the default (simonwillison.net). He notes AWS introduced monthly spend limits that pause a project when reached, still in limited release, and Google Cloud launched Spend Caps in July.

Impact for companies: for the first time, the major clouds offer a native circuit breaker for cost, not just an alert.

Risks and opportunities: a hard cap on a production workload is an availability decision. Applied to sandboxes, agent experiments and proofs of concept, it is pure upside.

My take: this is the FinOps control I have wanted for years. Alerts at midnight do not prevent a five-figure bill; a cap does. My rule: every non-production account and every agent-provisioned project gets a hard cap by default, and removing it requires a named owner. Production keeps alerts and anomaly detection — not a kill switch.

Reflection launches Beam, an open-weight model built for cost

Reflection AI unveiled Beam, a 501-billion-parameter mixture-of-experts model with 23 billion active parameters and a 1-million-token context window, claiming parity with Z.ai's GLM-5.2 on reasoning benchmarks at 3–4x less inference compute (techcrunch.com). Weights are due this month, distributed through hyperscalers and neoclouds.

Impact for companies: a credible Western open-weight option for teams that need data residency or cannot route sensitive data to a closed API.

Risks and opportunities: the claims are not independently verified yet. The opportunity is real for high-volume, well-defined workloads where token cost dominates.

My take: "workhorse model" is the right framing, and the right test is cost per resolved task on your own workload, not benchmark parity. Keep a model-agnostic gateway in front of your applications so swapping a model is a configuration change, not a project.

HackerRank's Chakra lets an AI run the technical interview

HackerRank made Chakra generally available: an AI interviewer that watches candidates work in a real repository with an AI assistant, asks follow-up questions and scores "AI fluency" (techcrunch.com). It ran more than 500,000 interviews in beta, collapses three rounds into one, and reports 70–80% fewer suspicious-activity flags. Humans keep the hiring decision.

Impact for companies: the technical interview is shifting from "can you produce the artifact" to "can you judge and steer the tool that produces it."

Risks and opportunities: automated hiring tools face bias audits and regulation, as in New York City. The opportunity is an interview that finally resembles the actual job.

My take: I agree with the diagnosis — anyone can produce code now, so judgment is the signal. I would not delegate scoring blindly, though. Calibrate any AI rubric against your own best engineers before using it on candidates, and keep the final conversation human.

The trend to watch

Discovery is getting cheap; remediation, triage and cost control are not. The organizations that come out ahead will not be the ones with the strongest model, but the ones that sized their capacity to absorb what the model finds: remediation budget before the scan, verification before the triage queue, hard caps before the agent deploys. Treat AI output as inbound demand on your team — and plan for it the way you plan for traffic.