Essay
Fix everything, and the next AI finds more. Security operations must be rebuilt as AI-native
SoftBank fixed all 10,500 vulnerabilities found in about 700 of its own systems, then a new AI released in September found 35,000 more. When people working harder can no longer keep up, what should we hurry to do?
Even after every vulnerability is fixed, each new generation of AI finds more. Rebuild operations so that AI runs them, and develop the young people who can do that, top-down.
"Utterly exhausted." Those are the words of SoftBank President Junichi Miyakawa. And yet it will only get more exhausting from here. And we cannot stop. That is the reality of moving to AI-native.
01SoftBank fixed 10,500 flaws, then a new AI found 35,000 more
In July this year, SoftBank fully launched "Patching as a Service," which supports everything from diagnosing vulnerabilities (weak spots in software that can become entry points for attacks) to applying patches (programs that fix those weak spots). As of October 30, 7,670 companies had signed up.
Before the full launch, the company applied the same system to itself. In June it diagnosed about 700 systems it had built in-house and found as many as 10,500 vulnerabilities. Over about three months, it patched every one of them.
But when it ran the diagnosis again with OpenAI's "GPT-6 Astra," released in September, it found as many as 35,000 new vulnerabilities.
At the earnings briefing on November 9, President Junichi Miyakawa said, "To be honest, we are utterly exhausted."
The exhaustion is not only about the number of vulnerabilities. At the briefing, the company explained that the ransomware attack on its subsidiary IDC Frontier, disclosed in October, took seven minutes. Reconnaissance against SoftBank's systems (scouting before an attack) has roughly doubled from a monthly average of about 300 million last year, it said. President Miyakawa also said that a model coming out next week could find yet more new vulnerabilities.
But what would turn up if they ran the diagnosis again now with Claude Mythos (Anthropic's AI model that is especially strong at finding vulnerabilities)?
02Fix everything once, and each advance in AI finds new vulnerabilities
The problem is that fixing everything once does not end it. Every time AI advances, vulnerabilities that could not be found before turn up one after another.
The scope of diagnosis also has to keep growing. SoftBank has widened its scans to more than 1,800 systems, including open-source software. It said one problem was that the open-source software that served as the route of intrusion had at first been outside the scope of the scans.
03Effort alone cannot keep up. Let AI keep monitoring, diagnosing, fixing and verifying
People working hard to keep responding can no longer keep up. We have to change to a system in which AI itself keeps monitoring, diagnosing, fixing and verifying.
Not using AI to do security, but making security operations themselves AI-native. Simply continuing to improve existing systems can no longer keep up.
Even at SoftBank, which is furthest ahead, the loop is not yet closed. Diagnosis and patching are increasingly automated, but checking that systems still work correctly after a patch still relies on people, and there is no set date for automating it, the company said.
We have already reached that stage.
04The urgent task: develop young AI-native talent who can rebuild the system, top-down
That is why I believe what we must hurry to do, above all, is develop young AI-native talent.
Not people who learn AI to maintain today's systems, but people who can rebuild the systems themselves from the ground up, assuming AI. And to do this top-down.
If we think of the next era as an extension of this one, we will be too late.
About this article
An essay by Tomoyasu Hirano, CEO of Teleport. SoftBank's figures, President Miyakawa's words and the other numbers presented at the briefing are from a CNET Japan article (November 10, in Japanese) reporting on the earnings briefing of November 9, 2026. The full-launch date (July 14) is from SoftBank's announcement, and the release of GPT-6 Astra (September 3, US time) is from an ITmedia Enterprise article. The disclosure of the attack on IDC Frontier (October 7) is listed in our feature "Japan's autumn 2026 data breaches spread through the services companies use."
The vulnerability counts come from SoftBank's announcement; the editors have not verified them. How many of them are serious is not clear from the reports. Counts also vary with the AI used for diagnosis and how findings are counted.
Teleport develops CITY, a system for protecting company systems with people and AI agents, and is working to bring it to businesses, so it has an interest in the argument of this essay.
On November 9, Teleport passed Anthropic's review and gained access to Claude Mythos (press release). You can see how we protect our own systems with people and AI agents in the film "Protecting a company with people and AI agents."
