Why agencies can no longer rely on patching alone in the frontier AI era

Frontier AI models have learned to do more than write code. They can now find and exploit flaws within it at machine speed. That shift is producing a surge of vulnerabilities that federal agencies can’t patch their way out of, according to Chip Childers, Senior Director at Broadcom.

In a new video produced by Scoop News Group and underwritten by Broadcom, Childers, who leads security, compliance, open-source and privacy engineering for Broadcom’s VMware Cloud Foundation division, said agencies must rethink security architectures and compliance practices built for a slower threat environment.

Childers traced the shift to coding assistants, the initial breakout use case for large language models. To help models write software, labs trained them heavily on code, inadvertently teaching them how software structures break and how to penetrate systems. Broadcom saw that dynamic firsthand as one of the first companies granted early access to advanced frontier models to test product security. Even with VMware products benefiting from more than 25 years of dedicated security investments, Childers noted that Broadcom, like others using frontier models, is now “finding orders of magnitude more” flaws.

The result is what the industry colloquially calls the “bugpocalypse,” with a new vulnerability disclosed roughly every six minutes. During offensive testing, Childers observed that “these models are incredibly creative and incredibly tenacious. Paired with a really good engineer, it takes almost nation-state-level threat actor capabilities and puts it in the hands of many more people.”

As cyberattack tools become more widely accessible, federal software supply chains face growing risks. Even when agencies run custom-built software, those systems still rely heavily on open-source code, databases, and underlying infrastructure. Because that code is publicly visible, attackers can use automated tools to quickly spot vulnerabilities or slip dormant threats into upstream repositories and build pipelines. Childers stressed that agencies must focus on “getting a firm handle on exactly where the bits are coming from, who built it and making sure it’s done in a really secure way.”

Traditional compliance calendars are ill-equipped to keep up with that speed. “The challenge with compliance in this new threat environment, given the volume of vulnerabilities, given the pace of patch deployment, is that it tends to not be risk-based,” Childers said. He pointed to the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive 26-04 as a model agencies must embrace, shifting the focus toward real-world exploitability rather than arbitrary deadlines.

Ultimately, Childers urged agency leaders to return to cybersecurity first principles by pairing patching with proactive platform defenses, such as microsegmentation to halt lateral movement and virtual patching to sever exploit attempts at the perimeter. “Patching will not get…ourselves out of this,” Childers said, emphasizing that defense must stop attacks before a patch is ever deployed.

Learn more about how Broadcom helps agencies counter frontier AI-driven threats with zero-trust lateral security and virtual patching.

This article and the video interview were produced by Scoop News Group for FedScoop and underwritten by Broadcom.