Do we have an infinite amount of them?
Security bugs and open math problems, one more parallel
Security bugs ⇔ open math problems. In Progressive disclosure for mathematical proofs I went through a few parallels between AI agents finding security bugs and AI agents proving theorems. Here is one more: do we have an infinite amount of them?
Bugs
Around the beginning of the Mythos moment, people basically forecast two possible scenarios. In the first, there is a finite number of bugs in the code, and models like Mythos will find and fix them all eventually. Bobby Holley, Firefox’s CTO, said so two weeks after Mythos Preview was announced, writing about the Firefox 150 fixes:
The defects are finite, and we are entering a world where we can finally find them all. (Holley 2026)
In the second, there may be a practically infinite amount of bugs. MTS and Gabriel put it as an old argument:
[W]e may be about to relitigate a long-standing argument in cybersecurity: are vulnerabilities in software finite or infinite? Dan Geer of In-Q-Tel famously framed the question like this: can you count vulnerabilities in software the same way you might count frogs in a pond?
I have seen some commentary online that early results from Project Glasswing suggest the answer is “no”. If Mythos can find a 27 year old bug in OpenBSD, the argument goes, perhaps there really are an infinity of vulnerabilities. If that’s true, then patching makes no difference. Remove one bug, an infinite number of others remain. (MTS and Gabriel 2026)
They side with finite: “This would be more persuasive if Mythos found, say, 1,000 27 year old bugs in OpenBSD.” Instead it found one, in some of the most widely fuzzed software in the world, which is what they would expect “if each subsequent vulnerability became marginally more difficult to find.”
Drew Breunig, in a post Simon Willison picked up, leaves it open, and the equation he gets depends on the answer:
If Mythos continues to find exploits so long as you keep throwing money at it, security is reduced to a brutally simple equation: to harden a system you need to spend more tokens discovering exploits than attackers will spend exploiting them. […] unless models reach the point of diminishing security returns, you still need to buy more tokens than attackers do. (Breunig 2026)
And especially consider that there is ongoing development introducing new bugs. Holley raises it himself, in a footnote to the same post:
There’s a risk that codebases begin to surpass human comprehension as a result of more AI in the development process, […] scaling bug complexity along with (or perhaps faster than) discovery capability. (Holley 2026)
Open problems
Is there a similar argument in math, about math being an infinite game with infinite problems to solve? I said mathematics is an infinite game (“likely true”) in What if the button came with the understanding?, and that infinite doesn’t mean there are plenty of good questions, as in Tao’s drinking water surrounded by a massive ocean (Tao 2026d).
On the finite side, Tao says the good problems are a resource, and AI labs are consuming it unsustainably:
Analogously to pre-atomic steel, open problems in mathematics generated before the AI era have, astonishingly, […] become something resembling a non-renewable resource. (Tao 2026c)
It is non-renewable because good problems take time to develop. In his Math 2.0 lecture, Math 1.0 solves open problems “in a renewable cycle”: solving pure math problems feeds human understanding, which poses the next problems. AI used to solve them directly, bypassing that understanding, breaks the cycle:
Indiscriminate use of AI to solve problems in a non-renewable fashion damages the long-term health and progress of the field, as well as safe transfer to messier, real-world applications. (Tao 2026b)
And the follow-up that used to come from a breakthrough, the talks, workshops and new collaborations, comes much less from the problems AI prompters solve and then leave:
This process cannot be easily reversed: a problem that has been “solved” cannot be somehow reverted to become “unsolved” […] And so solutions to open problems are now being harvested at large scale in an unsustainable fashion, leaving entire fields of mathematics much less fertile than when such problems were solved in the traditional “Math 1.0” fashion. (Tao 2026a)
On the infinite side, the same lecture:
Despite the impression given by press releases and social media, most of the problems at the current frontier of mathematics remain unsolved, even with massive computational expenditure. Indeed, the space of mathematical problems remains infinite; and the difficulty level of such problems is unbounded. Because of this, the future frontiers of mathematics will always continue to expand. (Tao 2026b)
So the parallel is this. Is it like Tao said, a finite resource, with AI labs mining it faster than it can grow back, the way Mozilla expects to run out of defects? Or do new solutions lead to new problems, the way new code leads to new bugs, so that there might be infinitely more open problems to explore, despite AI solving them at a faster pace?
To conclude, it seems that the amount of “trophies” you can claim is finite in both cases. But each time you claim one, it, together with the other activities around it, generates new trophies. A bug found tells you what pattern to look for elsewhere, which is how Madhavapeddy’s fix drew probes within ten minutes. A breakthrough in math brings the talks, workshops and follow-up problems Tao describes, though much less of that comes from a problem an AI prompter solved and left. Hence it becomes a race between the rates of these two “species”. Considering the entire game, all of software or all of math, both could theoretically be an infinite game. But if trophies are claimed faster than they are generated, each one is gone as soon as it comes up, and they become scarce anyway. And for the ones being generated, are they higher value or lower value than those they replaced?
The antiparallel part is what the trophy is. In a semiconductor, a hole is not a particle but a missing electron that moves around like one, like a bubble in water. A bug is that void: the source code is the material, and bug hunting is squeezing these voids away. The ideal case is to have no bubble. But math is not a material with voids in it. It is the medium itself, the vacuum, so you aren’t hunting for the absence of correctness. The closest analogy in my mind is a real new particle to be discovered, which is Tao’s lighthouse:
Particularly in pure mathematics, open problems serve as “lighthouses”: not destinations to be reached in and of themselves, but as useful guides to explore the mathematical landscape around these problems. (Tao 2026b)
So the same race means opposite things. In software, a void that is gone as soon as it comes up is the ideal case. In math, a lighthouse that is gone as soon as it comes up is the scarcity Tao is worried about.