The Symmetry Problem: Why AI Attackers and AI Defenders Share the Same Blind Spots

The author argues that attacker and defender AI have learned from the same public vulnerability corpus and thus both excel on well-documented vulnerability classes (e.g., SQL injection, XSS, memory-safety issues) but systematically miss business-logic, state-dependent, and application-specific authorization flaws; as a result, the AI-vs-AI arms race is concentrated on the same "mapped" terrain and leaves critical unmapped attack surface effectively uncontested.