OpenAI's AI maps software vulnerabilities into attack chains for defenders

Block's deployment isn't primarily about finding vulnerabilities faster; it's about reasoning across vulnerability chains to prioritize remediation by actual attack surface. That's a shift from vulnerability volume (how many CVEs) to vulnerability topology (which weaknesses chain into compromise). The qualifier: this only works if the LLM's threat modeling is accurate enough that defenders trust its prioritization over their own intuition.

This follows Sophos's 96% incident response acceleration (October 9) and Google's Gemini 4 Argon vulnerability detection gains (October 13), both showing frontier LLMs compressing security labor. But it arrives against a backdrop of asymmetric risk: the South Korean bank breach (October 8) demonstrated that commodity AI models like DeepSeek now enable single attackers to automate vulnerability discovery at scale. Block's use case assumes defenders can operationalize AI reasoning faster than attackers can weaponize it. The real test is whether enterprise adoption of AI-native threat modeling outpaces the offensive tooling democratization that already happened.

If Block publishes metrics on false positive rates for the LLM's attack chain prioritization within 90 days, and those rates stay below 15%, that signals the model is trustworthy enough for production triage. If they don't publish, assume the prioritization is still too noisy for defenders to act on without heavy manual validation, which would undercut the labor compression claim.