The Core Promise of Security Through Obscurity: If Nobody Looks, It's Safe

In security engineering, there is an ancient design philosophy called "Security through Obscurity": as long as the system's architecture, internal interfaces, and potential vulnerabilities are not known to outsiders, attackers cannot find an entry point and the system remains safe. For decades, this approach showed up across commercial software and protocol design — tucking legacy components like Telnet clients, Windows RNDIS, NFS Portmapper deep inside the system, since no one was reading the code anyway, so vulnerabilities would never surface.

But the premise of this approach is being dismantled at speed by a new class of tools: AI agents that can autonomously read code, trace call chains, and construct proof-of-concept exploits.

974 CVEs Is a Concentrated Burst, Not an Outlier

Last Tuesday, Microsoft's September routine security update patched 974 CVE vulnerabilities in one go — a record high, with cumulative patches this year already crossing 2,600. Compare that to a decade ago, when Microsoft shipped somewhere between a few dozen and a hundred patches per quarter, and the gap can only be described as exponential.

Dustin Child, a researcher at Trend Micro, noted when analysing this update that one phenomenon worth flagging is this: the components whose vulnerabilities Microsoft and Adobe patched have basically gone untouched for years — Telnet client, Windows RNDIS, NFS Portmapper, Link Layer Topology Discovery. In everyday user view these names have nearly disappeared. Their code sat deep in the system for over a decade with neither new feature work nor large-scale security audits — until AI agents started systematically scanning codebases and unearthed them one by one.

The reason security through obscurity is failing becomes obvious once you flip the framing: it bets on "no one is willing to spend time reading unmaintained code." For an AI, the marginal cost of doing so is close to zero. A ten-year-old Telnet client implementation that takes a human auditor weeks to review is, for a well-trained code-analysis agent, just a few seconds of scanning work.

The AI Arms Race on Both Offence and Defence

What makes security teams even more uneasy is that this shift is not one-sided. The Register, via Solidot's translation, reports that on the same workflow, attackers are using AI to reverse-engineer newly public patches and develop working exploits within hours. In other words, defenders use AI to dig out bugs, vendors ship patches, attackers use AI to immediately digest those patches and produce weapons — the whole loop has been compressed from weeks to hours.

That means the traditional security operations cadence, built around "disclose, patch, deploy" time gaps, is no longer sufficient in the AI era. System administrators no longer have a safe window of "slowly applying patches Monday morning."

Three Knock-On Effects as Security Through Obscurity Falls

First, the "archaeology cost" of code assets has been flattened. Maintaining a large but rarely audited codebase used to cost "no one knowing it exists"; now the cost is "it can be dug up by AI at any moment". Project maintainers face exponentially growing backlogs — small and mid-sized open source projects feel this most acutely, since they have neither the staff to respond at scale nor the comfort of "no one is looking."

Second, compliance risk for long-unmaintained components has surged. Telnet, NFS and similar protocols still run on many enterprise networks, but once AI digs out their vulnerabilities at scale and weaponises them, every system still running them becomes a high-value target. "Nobody has attacked our environment" carried no weight at all in 2026.

Third, dependence on independent security researchers will deepen further. AI agents amplify researcher productivity, but they also lower the bar for "finding bugs" to "able to run code." The result is that vulnerability disclosure volume will keep climbing, while researchers who can actually do deep analysis and ship fixes will become even scarcer.

So What

The failure of security through obscurity is not AI's fault, nor is it solely the attackers' victory. It is a clear signal: any security design that depends on "no one knowing" no longer works in 2026. Security investment going forward must shift from "reducing visibility" to "improving the underlying robustness of the code" — which means long-ignored legacy components either get modernised and rewritten, or get explicitly retired, instead of sitting inside systems waiting for AI to surface their flaws.

For CIOs and security teams, the question to answer now is not "are we patching enough vulnerabilities" but "how much of our code is still unread by AI?" That answer only gets more uncomfortable after every Patch Tuesday.

References: Solidot translation of The Register, original The Register article link is in the Solidot piece. Microsoft's September Patch Tuesday details can be cross-checked in this Solidot summary.