How long will the rapid update cycle last?

How long will the rapid update cycle last?

My hope is that projects will start applying bug-finding tools (including LLM-based tools) in earnest to code during the review phase, in order to stop there being a stream of CVEs for their project, and that we will not simply accept that security bugs are found after deployment.

If I'm right, then the increased capability-effort product from AIs will not result in more CVEs; it will result in more patches being fixed before they're applied to the mainstream project.

Thus, even with orders of magnitude more code being written, I hope to see the number of CVEs found by LLMs going down, not because fewer bugs are being written, but because tool-assisted review means that the bugs are found and fixed before the code gets to the point where a CVE can be issued.

And part of why I think this is plausible is that the tools don't get tired. If you give a human reviewer 10x the code to review, they'll start to make more mistakes over time, and more bugs will get past them; in contrast, the tools can be run in parallel, and if there's 100x more code, well, you just have the tool spend 100x the time on finding the bugs.