In 1989 the Supreme Court gave a name to something everyone already understood: practical obscurity. Your arrest record, your divorce filing, your lawsuit over a fender bender were all public. But to read them, someone had to know where to look, drive to the right county courthouse, and sit with a clerk and a box of paper. That friction was a kind of privacy. Nobody had promised it to you. It existed because finding things was expensive.
The Internet ended it. It didn’t make anything more public than it already was. It just made the courthouse trip free. Once records were scanned, indexed, and searchable, the protection disappeared, and we discovered that a great deal of what we called privacy had only ever been inconvenience.
Software’s courthouse
Software has been living under the same arrangement. Security people call it obscurity from complexity. Almost every program of any size is full of flaws: a check someone forgot, a buffer that can overflow, an assumption that holds until an attacker breaks it. The code is often sitting right there to be read. What kept most of it safe was that reading it carefully enough to find those flaws took scarce, expensive expertise.
So most bugs were never found by anyone hostile. A skilled attacker could spend weeks on one target, which meant attackers had to choose. They went after banks, governments, and big platforms. The rest of the world’s code was protected by the same thing that protected your divorce papers: nobody competent could be bothered to dig.
The free courthouse trip, again
AI is doing to bug-hunting what search engines did to court records. A model that can read code with something like expert attention doesn’t get tired, doesn’t bill by the hour, and can be copied ten thousand times. The expensive part of finding vulnerabilities is becoming cheap, and the choosing stops. Every target becomes worth a look, because looking costs almost nothing.
The AI companies know this. Frontier labs are already pointing their most capable models at critical software and handing what they find to the people who maintain it, trying to get defenders through the door first. That race is the right instinct. It also tells you how seriously the people building these systems take what’s coming. Code that was safe because it was hard to understand is about to stop being hard to understand.
Where the analogy breaks
The analogy is close, but there is one difference, and it matters. When your court records went online, the exposure was permanent. You couldn’t patch a divorce filing. The information was simply out, forever, for anyone.
Bugs can be fixed. A flaw that gets found can get patched, and a world where finding flaws is cheap could, in the long run, be a world with far fewer of them. That is the optimistic case, and it’s real: the same models that let an attacker find a hole let a defender find it first. The end of practical obscurity was only a loss. The end of obscurity from complexity could turn out to be a gain.
The trouble is the word “could,” and the long stretch of time before “in the long run” arrives.
Who pays
Patching takes people, money, and a system built to be updated. The software that gets fixed quickly is the software that’s already well kept: the big browsers, the major operating systems, the platforms run by companies with security teams in the hundreds. They’ll take the hit and adapt.
The code that can’t be fixed quickly is everywhere else. It runs the controller at a rural water plant, the infusion pump at a county hospital, the traffic system in a town with one IT person who is also the person who fixes the printers. Much of it was installed fifteen years ago by a vendor that no longer exists. Some of it can’t be updated at all without replacing the machine it runs on. These are the court records of the new era: their flaws are about to become cheap to find, and nobody can take them back.
So the cost doesn’t fall evenly. It falls on public infrastructure, small institutions, and the places without money to spare, which are, not by coincidence, the same places that were least able to protect themselves when practical obscurity ended for people.
The lesson we didn’t learn
When the Internet ended privacy by obscurity, we mostly shrugged and adjusted after the damage was done. Data brokers got rich and people-search sites became a business. The law spent two decades catching up, and it still hasn’t finished.
We’re getting a second chance with security by obscurity, and this time we can see it coming. The fix isn’t mysterious. Fund the replacement of unpatchable systems in the places that can’t afford it. Give small institutions access to the same AI defenders the big companies are already using. Treat the old code running our water and our hospitals as the exposed records they are about to become.
The courthouse trip just became free again. The question is whether we lock the doors before or after everyone notices.
