An top-tier ethical hacker has flagged concerns that the competitive bug hunting era may be coming to an end, as artificial intelligence tools grow powerful enough to outpace even the most experienced human researchers. Valentina Palmiotti, known professionally as Chompie, established herself as the leading solo participant at Pwn2Own Berlin, the world’s most prestigious hacking competition, where she secured nearly $70,000 in competition winnings by identifying critical vulnerabilities in major software systems. Yet notwithstanding her success, she raised alarm that cutting-edge machine learning models—particularly Claude Mythos, developed by Anthropic—will soon make it impossible for human competitors to compete. “I took part in Pwn2Own this year because I felt it might be my last chance,” she told BBC News, underscoring concerns that machine learning-powered security analysis will radically reshape the ethical hacking sector across the industry.
The Pwn2Own champion’s pivotal achievement
Chompie’s prominence at Pwn2Own Berlin showcased the remarkable expertise necessary for success at the world’s most demanding hacking competition. On the initial day of the competition, she performed a advanced strike against an Nvidia-linked system, securing $20,000 for her performance. Rather than settle for her achievements, she immediately returned to her accommodation to get ready for the subsequent round, entering what she describes as “zombie hacker mode”—an intense state of unbroken effort fuelled by energy drinks and adrenaline that went on throughout the night.
The toll of this constant drive became evident when footage from the competition showed Chompie on stage looking at once jubilant and worn out after successfully hacking into a Linux-based system to claim an additional $50,000 prize. She had worked from 6pm until 6am non-stop, a punishing twelve-hour marathon that she admitted was far from healthy. Yet such dedication has become common practice amongst elite competitors, who stretch themselves to the maximum of human endurance to achieve wins at the esteemed annual tournament. Chompie’s total earnings of almost $70,000 reflected not just technical skill but absolute commitment.
- Infiltrated Nvidia-linked system for $20,000 on day one
- Laboured twelve hours straight without sleep for the second try
- Successfully breached Linux system earning extra $50,000
- Described the intense competitive state as “zombie hacker” state
How artificial intelligence is transforming the cyber threat environment
The incorporation of AI technology into security operations has substantially changed how ethical hackers approach their work. Tools like Claude Code have served as crucial tools, enabling researchers to speed up their detection of vulnerabilities and optimise their testing methodologies. For competitors like Chompie, these intelligent platforms have delivered a competitive edge during demanding lengthy contests, allowing them to operate with greater productivity whilst preserving the intensity required to excel at top-tier events. The technology has made more accessible specific elements of bug hunting, rendering complex approaches more available to a wider spectrum of cybersecurity experts worldwide.
However, this digital transformation has created a troubling paradox. Whilst existing artificial intelligence systems function as useful additions to human knowledge, more advanced systems threaten to render human competitors obsolete completely. Anthropic’s Claude Mythos has already demonstrated the potential scale of this upheaval, said to have uncovered 1,600 vulnerabilities throughout numerous software programmes—a capability that far exceeds what lone security researchers can accomplish through traditional methods. The company has limited availability to governments and select cybersecurity institutions, recognising the potential for both beneficial and harmful applications of such advanced systems.
The existing edge for researchers working with humans
At this time, ethical hackers occupy what Chompie describes as a “sweet spot” where artificial intelligence serves as an enabler rather than a replacement. Contemporary AI tools are particularly effective at accelerating routine tasks, automating code analysis, and suggesting research directions that might otherwise necessitate hours of manual investigation. For security researchers operating within high-pressure environments—whether competing at Pwn2Own or conducting vulnerability assessments for organisations like IBM X-Force—these tools have become vital efficiency enhancers. The human element remains paramount, requiring creativity, intuition, and strategic thinking that current AI systems cannot completely match.
This joint advantage has allowed champions to push their performance boundaries further than previously possible. By transferring processing-intensive tasks to artificial intelligence tools, leading penetration testers can concentrate their mental energy on tackling intricate challenges and novel attack vectors. The technology has extended human capability rather than substituted for it, creating a mutually beneficial partnership where the combined efforts of humans and machines are essential for accomplishing goals. Yet this equilibrium looks unsustainable, with increasingly advanced systems already in development.
The upcoming turning point
The cybersecurity community confronts an imminent technological inflection point as advanced artificial intelligence models materialise. GPT 5.5 Cyber and similar systems promise capabilities that will fundamentally exceed human performance in identifying vulnerabilities. Unlike existing systems that enhance researcher capabilities, these advanced models are designed to operate with limited human involvement, potentially identifying and exploiting security flaws at pace and magnitude that humans cannot match. This shift represents a watershed moment for the hacking landscape, where traditional skills may become insufficient against artificial intelligence-powered methods.
Chompie’s determination to take part at Pwn2Own this year demonstrates a broader anxiety within the ethical hacking field about the continued feasibility of human-led contests. As AI systems become increasingly advanced, the scope of human-led security competitions and hacking competitions may quickly narrow. The constraints placed on Claude Mythos to specific organisations emphasises how deeply technical specialists perceive this challenge, yet such restrictions offer only short-term relief. The period of competitive vulnerability discovery that has characterised security research for decades appears poised for transformation within the near future.
Conflicting perspectives on humanity’s future in digital security
Whilst Chompie’s reservations about AI dominance echo across the cybersecurity sector, not all IT security specialists share her negative perspective. Some argue that human insight, originality and judgment will always hold core importance in penetration testing. They point to the erratic character of security problems and the importance of contextual understanding that machines have trouble reproducing. These optimists propose that rather than displacing security researchers, advanced AI will keep developing as a instrument that improves the entire profession, allowing researchers to address more sophisticated challenges whilst upholding human supervision and moral boundaries.
The discussion illustrates a wider divide throughout cybersecurity concerning technical innovation and career identity. Senior professionals recognise that AI will certainly overhaul vulnerability reward schemes and hacking competitions, but they emphasise that human expertise stays indispensable in strategic decision-making and risk evaluation. Organisations such as Anthropic have purposefully controlled availability of sophisticated models precisely because they recognise the potential hazards of unchecked AI-driven vulnerability detection. This measured approach suggests the time ahead may involve combined approaches where people and artificial intelligence work together under tight controls, instead of total substitution of skilled hackers with autonomous systems.
- Human creativity crucial for new offensive approaches AI cannot anticipate
- AI governance with limited availability may preserve market advantages
- Hybrid human-AI teams probable to determine the future of cybersecurity
Consequences affecting both defensive and offensive players
The expansion of AI-powered flaw identification introduces a dual-edged sword for the cybersecurity landscape. Whilst ethical hackers and security researchers have historically served as the primary defensive barrier, uncovering weaknesses before malicious actors can leverage them, the widespread availability of AI tools risks level this playing field. If powerful models gain broad access, cybercriminals could theoretically discover vulnerabilities at volume, possibly exceeding the ability of security teams to patch systems. This asymmetry could significantly change the cost dynamics of cybersecurity, forcing organisations to allocate substantially greater resources in defensive measures and rapid response capabilities to offset expedited vulnerability discovery.
Conversely, the identical AI capabilities could enhance defensive operations substantially. Security teams armed with cutting-edge AI systems could theoretically detect and fix vulnerabilities more quickly than previously possible, potentially staying ahead of threats. The critical variable lies in access and control. If AI vulnerability discovery tools remain tightly restricted to approved security organisations and governments, as Anthropic currently ensures with Mythos, defenders may preserve their superiority. However, should such technologies eventually leak or be deconstructed, the consequences could be severe, making the issue of prudent rollout and control mechanisms essential to cybersecurity’s long-term security.
The illicit hacking landscape
The prospect of AI-assisted vulnerability discovery in the hands of cybercriminals constitutes perhaps the most alarming scenario facing the cybersecurity sector. Criminal threat actors have consistently demonstrated their ability to weaponise new technologies faster than defenders can adapt. If criminal organisations gain access to models like Mythos, they could conduct automated searches for vulnerable weaknesses across extensive areas of software and infrastructure, essentially automating the vulnerability discovery process. This would grant them unparalleled velocity and breadth in locating targets, potentially overwhelming the capacity of security researchers and defensive personnel to respond effectively.
Anthropic’s decision to restrict Mythos access demonstrates keen understanding of this risk. The company explicitly acknowledged the model’s capacity for abuse, limiting distribution to chosen authorities and security organisations. This gatekeeping approach, whilst controversial, constitutes a pragmatic recognition that unrestricted artificial intelligence availability could empower unlawful organisations disproportionately. However, such restrictions may prove temporary. Evidence indicates that advanced systems ultimately spread beyond their intended boundaries, raising uncomfortable questions about the duration for which responsible deployment practices can restrain instruments created expressly to uncover concealed vulnerabilities in digital infrastructure.
Responsible introduction as the key element
The future trajectory of ethical hacking and cybersecurity is heavily influenced by how the technology industry handles AI vulnerability discovery tools. Establishing robust governance frameworks, access controls and accountability mechanisms will be vital to stopping misuse whilst supporting legitimate security research. Industry partnership between technology companies, security researchers, governments and law enforcement could help establish standards for responsible deployment. Such frameworks might feature controlled access agreements, usage monitoring, and international collaboration to keep tools away from criminal networks. Without proactive governance, the strategic advantage currently possessed by ethical hackers could disappear within years.
Chompie’s choice to take part at Pwn2Own whilst the opportunity remains reflects a wider imperative within the cybersecurity research community to create standards and safeguards before AI fundamentally reshapes the landscape. Security professionals, policymakers and technology companies must work together to ensure that powerful AI tools strengthen rather than undermine cybersecurity defences. This demands openness regarding functionality, accurate evaluation of risks, and willingness to implement restrictions that may create challenges for experts but protect critical infrastructure. The window for establishing responsible precedents may be closing, making immediate action vital to preserving human expertise and ethical oversight in an rapidly mechanised security ecosystem.