⏱️ Lectura: 9 min
The FBI coined this “going dark” in 2014: suddenly losing the ability to intercept digital communications. Twelve years later, cryptographer Matthew Green, of Johns Hopkins, warns in an analysis published on August 14, 2026, that the scenario is about to repeat itself, but with an unexpected twist.
📑 En este artículo
- TL;DR
- What happened: AI revives the “going dark” debate
- Context and history: from payphones to WhatsApp
- Technical details: what changes with AI that hunts bugs
- How to check the encryption of your own tools today
- Impact and analysis
- What’s next
- Frequently Asked Questions
- What exactly does “going dark” mean?
- What is Mythos, and why did the United States restrict its export?
- How did police hack iPhones before this?
- Does cybersecurity AI make encryption useless for protecting you?
- How does this relate to backdoor laws in other countries?
- Can I use a tool similar to the one Green describes today?
- References
This time the threat isn’t a new encryption algorithm, but artificial intelligence that’s patching software faster than intelligence agencies can exploit it. Green wrote the piece fresh off Usenix Security 2026, the security conference held in his hometown, Baltimore.
TL;DR
- Matthew Green (Johns Hopkins) published an analysis on AI and surveillance on August 14, 2026, following Usenix Security 2026 in Baltimore.
- Anthropic released Mythos in April 2026, a model especially skilled at finding software vulnerabilities.
- The United States temporarily blocked Mythos’s export, restricting it to its own agencies and trusted vendors.
- OpenAI, Z.ai, and Moonshot have already proven that AI-driven vulnerability hunting isn’t the monopoly of a single lab.
- In 2014 the FBI launched the “Going Dark” initiative following the arrival of iPhone disk encryption (2010) and WhatsApp’s end-to-end encryption.
- In the 2016 Apple vs. FBI case, a third-party company hacked the shooter’s iPhone without Apple’s help.
- Defensive teams are already rebuilding entire CI pipelines to scan for vulnerabilities with AI before code reaches production.
What happened: AI revives the “going dark” debate
Green’s argument starts in April 2026, when Anthropic unveiled Mythos, a model unusually skilled at finding software vulnerabilities. The US government temporarily blocked its export, restricting access to its own agencies and trusted vendors.
The restriction turned out to be almost irrelevant: OpenAI, along with Chinese open-weight labs like Z.ai and Moonshot, soon showed that AI-driven vulnerability hunting isn’t something a single lab can monopolize. The list of serious flaws these models find grows every week.
At first glance this looks like good news for the offensive side. Green believes the opposite will happen in the long run: defenders are patching decades of accumulated bugs, and entire engineering teams are rebuilding their continuous integration pipelines to incorporate AI vulnerability scanning before code reaches production.
Context and history: from payphones to WhatsApp
Green uses a pop culture reference to explain the shift: the first season of The Wire (2002) shows police wiretapping payphones and disposable cell phones. None of that would have surprised a 1989 agent. Less than a decade after that premiere, all that technology had become obsolete.
The turning point came in the late 2000s with smartphones and text messages: as phones began to store data, not just transmit it, their content became a valuable source for law enforcement. That lasted until 2010, when Apple began encrypting iPhone storage with a key derived from the user’s passcode (Android followed shortly after). The following year, Apple added end-to-end encryption to iPhone text messages.
By 2014, a small messaging app called WhatsApp already had 600 million users worldwide. By 2016, those users (nearly a billion) were using end-to-end encrypted messages and calls by default. That same year, FBI Director James Comey announced the Going Dark initiative, meant to open a national conversation about what providers could (or should) do to keep those communications readable for law enforcement.
In 2016 the agency took the dispute to court: after an attack, the FBI had the shooter’s locked iPhone and ordered Apple to give it access. Apple refused. What broke the deadlock, and in a sense ended “Going Dark” as it was known, was something neither the FBI nor Apple expected: a third-party company announced it could hack the phone without Apple’s help. Over the following decade, police turned to tools like GrayKey to unlock phones or remote exploits like NSO Group’s Pegasus instead of pushing for legislated backdoors.
Technical details: what changes with AI that hunts bugs
That whole balance (manufacturers closing gaps, exploit hunters staying one step ahead) depended on vulnerability discovery remaining slow, human work. What Green describes is that this asymmetry is about to break in favor of the defensive side.
| Historical access route | When it was used | Advantage | Limitation |
|---|---|---|---|
| Legislated backdoor (exceptional access) | Proposed 2014-2016, never passed in the US | Access guaranteed by law | Weakens encryption for all users |
| Purchased exploits (GrayKey, Pegasus) | 2016-2026 | Doesn’t require manufacturer cooperation | Expensive, depends on unpatched bugs existing |
| Third-party-led hacking | Apple vs. FBI case, 2016 | Avoids legal litigation | Doesn’t scale, each device requires new work |
| AI vulnerability scanning (defensive side) | Since April 2026 | Closes bugs before release | Shrinks the inventory of available exploits, including for police |
💭 Key point: calculating the exact number of bugs in a program is, in practice, an undecidable problem (a variant of the halting problem). That’s why Green doesn’t believe AI will find “all” the bugs, but rather that it’s approaching a ceiling of useful, exploitable bugs, and that ceiling could be reached soon.
flowchart TD
A["Manufacturer writes new code"] --> B["AI scans for vulnerabilities in the CI pipeline"]
B --> C{"Was an exploitable bug found?"}
C -- "Yes" --> D["Patched before release"]
C -- "No" --> E["Code reaches production"]
D --> F["Fewer exploits available to buy"]
E --> G["Agencies could exploit the remaining bug"]
F --> H["Risk that police are left without access"]How to check the encryption of your own tools today
You don’t need to wait for the legislative debate to move forward to check the security of your own services. Two quick checks help illustrate what Green is talking about in practice.
First, confirm which TLS version your own server negotiates:
openssl s_client -connect tuservidor.com:443 -tls1_3 -briefIf the connection responds with Protocol version: TLSv1.3 and a Cipher line with a modern suite (for example TLS_AES_256_GCM_SHA384), the channel is using up-to-date encryption. If the command fails at -tls1_3, your server is still negotiating older, exposed versions.
Second, try the same kind of pre-release vulnerability scanning Green describes, at local scale, with an open source tool like Semgrep:
# macOS
brew install semgrep
# Linux
python3 -m pip install semgrep
# Windows (PowerShell)
pip install semgrep
# Run the scan on your repo
semgrep scan --config auto .💡 Tip: run the scan in your own CI before merging, not after release: that’s exactly the logic Green describes large-scale defense teams already adopting.
Impact and analysis
The paradox Green raises is uncomfortable: more secure software is, in the abstract, good news for everyone, including privacy advocates. But if intelligence agencies lose their informal access route (buying or finding exploits) the political pressure to legislate mandatory exceptional access could return stronger than in 2014.
The Apple vs. FBI precedent showed what happens when the government clashes with a manufacturer that refuses to cooperate: at the time, a third party solved the technical problem and lowered the political temperature. If that kind of technical way out stops being available because there are no more unpatched bugs to buy, the only option left is the legislative one, the same one the cryptography industry has been resisting for over a decade.
⚠️ Watch out: the same AI that patches bugs can also be used to find them for offensive purposes. Nothing guarantees the patching pace will always outrun the exploitation pace, especially if a state actor trains its own model without the export restrictions that currently limit Mythos.
What’s next
What Green leaves open is whether governments will interpret this closing of technical routes as an argument for pushing legislated backdoors, something already being debated in other countries under different frameworks. The underlying question for 2026 and 2027 isn’t whether AI keeps getting better at finding bugs (that’s already happening), but whether the pace of defensive patching is enough to sustain the argument that strong encryption, without backdoors, remains compatible with public safety.
📖 Summary on Telegram: View summary
Try it yourself: run openssl s_client -connect tuservidor.com:443 -tls1_3 -brief today against one of your own services to confirm what encryption it uses before the legislative debate decides for you.
Frequently Asked Questions
What exactly does “going dark” mean?
It’s the term the FBI used starting in 2014 to describe the loss of its ability to access digital communications due to the advance of encryption. Matthew Green revives it to describe a similar phenomenon, this time caused by AI closing software vulnerabilities.
What is Mythos, and why did the United States restrict its export?
Mythos is an Anthropic model announced in April 2026, noted for its unusual ability to find software vulnerabilities. The US government temporarily limited its export to its own agencies and trusted vendors.
How did police hack iPhones before this?
Mainly with tools bought from third parties, like GrayKey for physical unlocking or NSO Group’s Pegasus for remote exploitation, rather than relying on a legislated backdoor that was never passed in the United States.
Does cybersecurity AI make encryption useless for protecting you?
No: on the contrary, according to Green it strengthens protection, because it closes the bugs that previously allowed bypassing encryption without breaking it. The side effect is that agencies that relied on those bugs lose that access route.
How does this relate to backdoor laws in other countries?
Green suggests that if the informal technical route (purchased exploits) runs dry, political pressure to demand exceptional access by law could intensify, in line with debates already happening in various jurisdictions over encryption and surveillance.
Can I use a tool similar to the one Green describes today?
You can try open vulnerability scanners like Semgrep in your own CI pipeline. They don’t have the capability of a model like Mythos, but they apply the same logic of detecting bugs before release.
References
- Everything is about to “go dark” (Matthew Green’s blog): the original analysis that inspired this article.
- Apple-FBI encryption dispute (Wikipedia): detailed context on the 2016 court case.
- NSO Group (Wikipedia): background on Pegasus, the remote exploitation tool mentioned in the article.
- Anthropic: the lab that developed Mythos, the model Green points to.
📱 Do you like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
0 Comments