Thai Duong, Founder of Calif: AI That Can Code Is Inherently a Hacker; This Is Not a Bug to Be Fixed
Thai Duong, founder of cybersecurity firm Calif, and engineer Bruce Dang make a structural argument on the Bloomberg Odd Lots podcast: an AI's coding ability and hacking ability are fundamentally the same capability and cannot be separated. Duong cites his twelve years of security work at Google, noting that when AI was directed at Chrome—a browser considered highly secure—it found ten times the expected number of vulnerabilities. The PHP vulnerability case further illustrates that AI’s key contribution lies not in discovering vulnerabilities, but in converting known flaws into working exploits. Using the historical chess analogy of the 'centaur' era, they argue that while the strongest hackers are human-AI combinations, this window may last only from months to a few years.
In a podcast interview in late October 2026, Thai Duong, founder of cybersecurity firm Calif, put forward a judgment that sounds simple but carries profound consequences: if you train an AI to be good at writing code, you simultaneously train it to be good at hacking. This is not a bug that can be fixed; it is a structural property of the capability.
Duong’s reasoning chain is as follows. AI companies make money by selling tokens, and the current largest use of tokens is programming. A truly proficient programming AI must understand code, understand technical systems, be able to debug, and control computers—and Duong argues that this is precisely the definition of hacking. You cannot allow an AI to reach commercial levels of proficiency in programming while keeping it blind to system vulnerabilities.
This judgment is supported by concrete operational evidence. Duong worked at Google for twelve years, responsible for security testing before products like Chrome were released. He and the entire industry assumed that Chrome’s security investments had yielded results—not only eliminating vulnerabilities but also implementing mitigations that made them difficult to exploit. However, when they directed AI at Chrome, they discovered approximately one thousand vulnerabilities, ten times the expected amount. Duong said this surprised him greatly: either security engineers were underperforming, or the volume of code was so vast that manual auditing could never cover it all.
In contrast, the process of discovering PHP vulnerabilities illustrated the differing roles of AI across stages. Calif secured funding and tokens through OpenAI’s Patch the Planet program. Engineer Ryan Osteen found the first vulnerability just one or two days after launching the effort on July 30. But what made the situation urgent was not the discovery itself—the PHP Foundation had identified the same vulnerability back in 2024—but rather the exploitation. The foundation had chosen not to fix it because the repair cost was too high and there was no publicly available exploit method at the time. AI’s key contribution lay in developing the exploit code: engineers provided the AI with design directions for how to leverage the flaw, and within a day, the AI produced a working exploit, proving that remote attackers could compromise websites without any specialized knowledge.
Duong also described a collapsing time window. In the past, it typically took weeks or even months for attackers to develop usable exploits after a patch was released, giving users ample time to upgrade. Now, the moment an open-source project’s fix is published on GitHub, the information is already exposed. Attackers can monitor repositories and use AI to convert patches into exploits within hours. Duong calls this a 'minus-one-day vulnerability': by the time the patch reaches users, the exploit is already ready.
Regarding changes in attack speed, Duong supplemented this with a case involving a banking client. After the Calif team entered a client’s network, it usually took about a month to horizontally penetrate the entire system. An attacker’s AI, however, entered the network on Monday and was everywhere by Tuesday. Duong described this as cancer spreading at machine speed; existing detection systems cannot keep up—you detect the intrusion, but there are already a hundred attack points in the system, and shutting down operations is not an option for a bank.
Engineer Bruce Dang demonstrated another way AI has changed hacking work. He co-authored a textbook on reverse engineering with friends, spending a long time completing it. But nine months ago, the content of that book was already obsolete—today, it takes only one or two prompts for AI to generate similar content, often better. Dang also mentioned a friend who spent five dollars using an open-source model to reverse-engineer printer firmware and successfully hack it, whereas such a task previously required months of work.
Looking to the future, Duong used an analogy from chess history. After IBM’s Deep Blue defeated Garry Kasparov in 1997, because Deep Blue was a mainframe computer that ordinary PCs could not run, the strongest chess players over the next decade were 'centaur players'—human-computer combinations. After AlphaGo defeated Lee Sedol in 2016, pure software surpassed all human-machine combinations in just three years. Duong believes cybersecurity is currently in the 'centaur hacker' era: the strongest hackers are combinations of AI and human experts, but this window may last only three months to three years. He is uncertain about this prediction but advises preparing for the shorter timeframe.
The boundaries of this argument lie in its description of structural constraints under current AI capabilities, rather than eternal truths. Duong himself acknowledges that if AI companies abandon programming business to focus on scientific discovery or physical AI, it would theoretically be possible to train models that are not proficient at hacking. But this would mean abandoning their largest revenue source. Formal verification can theoretically prove software security, but Dang points out it is currently applicable only to small components, not to systems with billions of lines of code like browsers. Duong adds a more fundamental constraint: software dominates the world precisely because it can be modified at any time; requiring software to stop changing frequently would amount to asking tech companies to abandon their core competitive advantage.
On defense prospects, Dang expressed conditional optimism: perhaps AI will eventually help build more secure systems, though he admits he may be overly optimistic. Duong is more direct: in the current phase, AI helps attackers more than defenders, and defenders need time to catch up. They do not believe there is a simple solution like 'fixing the sandbox makes it safe,' nor do they think it is possible to train a model that codes but does not hack. The path forward for defense lies in redesigning system architecture, rather than patching existing structures.