Cloudflare's Zero Wire and CWE-bench v2 show where AI security goes: triage, then the tail
Serguey Asael Shinder1 min readTwo releases on 3 November look at the same problem from opposite ends. Cloudflare launched Zero Wire, a feed of plain-language briefings on critical, Internet-facing vulnerabilities, and justified it with AI-driven discovery that, in its words, is increasing both the number and the speed of critical disclosures. The same day Collinear AI published CWE-bench v2, 100 public tasks in which an agent must find and fix a real weakness in an open-source repository without breaking it.
Read together, they describe a pipeline. At the front, more disclosures arrive faster than a team can read vendor advisories, so the scarce resource becomes triage: knowing whether a bug is exploited, whether a fix exists and who should look. Zero Wire's cards separate exactly those states and add a prompt a team can hand to its own agent to check exposure. At the back, the fix itself is increasingly something a model can attempt: the best model on CWE-bench v2 passes 67.8% of tasks on the first try and 81% within four.
The same benchmark marks the limit. Even the leader fails 19% of the tasks on every attempt, and the fixes are graded by verifiers that check behaviour rather than one expected patch. Rails, which shipped 21 security fixes on 4 November, is a reminder of how much of the work is still release management: a supported-version deadline three days later and an upgrade every user has to schedule.
What it means
The practical shift is in where people spend their time. Reading every advisory and writing routine patches are the parts being automated first; deciding what matters for your own systems, and checking the fixes a model proposes, are the parts that are not.