From glasswing to fable: AI-scale vulnerability discovery and the governance of selective inoculation

AI-enabled vulnerability discovery can convert dispersed latent software flaws into concentrated actionable vulnerability knowledge, transforming vulnerability governance from a case-by-case disclosure problem into one of managing large inventories, powerful discovery capabilities and selective access. Existing scholarship retains the individual vulnerability as the practical unit of governance. This article argues that AI-scale discovery strains that assumption and creates a distinct policy category: selective inoculation, defined as the controlled provision of a vulnerability-discovery capability or vulnerability inventory to a limited set of actors for defensive hardening before wider disclosure or diffusion. Using Anthropic’s Project Glasswing and the subsequent Fable episode as illustrative cases, the article distinguishes latent vulnerability from actionable vulnerability knowledge, explains AI-enabled risk activation, and offers criteria for assessing future selective hardening arrangements. The central problem is not that AI creates underlying flaws, but that it can make existing flaws actionable at a scale existing governance frameworks were not designed to absorb.