The U.S. Vulnerabilities Equities Process (VEP) was designed for a world where human researchers found security flaws one at a time. According to a recent Lawfare analysis, that world is ending. The oncoming wave of AI-driven vulnerability discovery will flood the process with far more candidates than it can handle, forcing a fundamental rethink of how the government decides which flaws to keep secret for offensive use and which to disclose for defense.
The article argues that the current process, which weighs disclosure against retention on a case-by-case basis, cannot scale to the volume AI will produce. It calls for moving beyond the VEP entirely, toward a new framework that anticipates the AI-driven flood rather than reacting to it. The piece stresses that the choice is not simply about efficiency; it is about maintaining trust and security as automated tools reshape the vulnerability landscape.
Because this is a single source, there is no independent counterpoint to compare. The analysis stands as a policy argument, not a report of enacted change. Still, it highlights a growing concern among cybersecurity experts: the rules for handling vulnerabilities were built for a slower, more human era, and they may not survive contact with AI.