Everything hackable will get hacked

AI-assisted security review produces leads that still need investigation. In this August 2026 account, Vercel's CTO Malte Ubl describes deepsec, an open-source tool he created at Vercel for analyzing large codebases for potential vulnerabilities. He says a full review surfaces vulnerability hypotheses to investigate, and advises reviewing every finding yourself and comparing the results with what your current security process already catches.

Vercel says it runs full deepsec reviews on mission-critical repositories every quarter and whenever a stronger model becomes available, alongside automated security reviews on every pull request. That makes broad codebase review a recurring activity rather than a one-time audit. The article also describes an open-weight model, Kimi K3, investigating Vercel Sandbox: it mapped the guest-kernel attack surface, followed possible privilege escalation paths, and ran a fuzzer, but did not escape. The distinction matters: extensive investigative activity is evidence of a research process, while a working exploit requires a demonstrated result. Ubl's view that such an investigation could succeed against a vulnerable surface is his assessment, not an observed outcome.