A review of recent PHP, certificate-authority, cloud and package-supply-chain incidents argues that AI can shorten the path from vulnerability discovery to exploit development, but did not cause every incident. Expertise is still needed to distinguish broken proofs of concept from working attacks. Closing source code alone is not a solution; avoiding disclosures before patches are ready and providing exceptions for urgent security updates matter more. One unusually difficult week does not establish that this pace will continue indefinitely.