AI security links live vulnerability protection with permanent code fixes

An AI security approach could block vulnerabilities in running systems within hours, then repair the underlying code. It connects temporary protection and permanent fixes in a single workflow without requiring a restart.

In its “Defense in Depth, Rebuilt for Machine Speed” report published on 2026-11-06, Andreessen Horowitz said the next generation of security tools could protect production systems first. Options include filtering malicious requests, blocking dangerous inputs inside an application and applying patches directly in memory without restarting.

Managing live fixes has been difficult because internal and third-party libraries run across many versions, the publisher said. Coding agents could create protections for the versions actually deployed and check compatibility. They would then prepare a matching source-code patch, open a pull request and verify that the permanent repair matches the live protection.

The live protection could run on infrastructure companies already use, including content-delivery networks and API gateways. The security product would read vulnerability advisories, check deployed versions and create a narrowly targeted fix. It would test against live or recorded traffic, observe without blocking where possible, then expand enforcement in stages with automatic rollback.

Permanent code repairs would proceed on a separate track. AI would patch the production versions and replay recorded traffic to check that existing functions still work. Once the permanent patch ships, the temporary protection would be removed. Andreessen Horowitz identified the key measures as hours from disclosure to protection, days to a permanent fix and how often live protection blocks legitimate traffic.

A deeper defensive layer would target recurring attack techniques rather than individual vulnerabilities. According to the report, 48,185 vulnerabilities were published in 2025, of which 884 were newly exploited. It also cited CISA’s review finding that most weakness types behind its exploited-vulnerability list have had known prevention methods for decades.

This approach would place monitoring hooks where applications parse untrusted input or call operating-system functions. Those hooks could detect a vulnerability turning into attacker control, such as a web server unexpectedly launching a shell. A small AI model would decide during the request whether to allow, block or escalate the activity.

A larger model or an analyst could review escalations within seconds and deploy a new blocking rule, the publisher said. Responses could range from dropping a request to terminating a process or isolating a machine. Andreessen Horowitz cautioned that faulty fixes deployed at machine speed could themselves cause downtime, making staged deployment and automatic rollback essential product features.