Sarah Guo is pointing at a real inflection: the CVE spike she cites coincides with AI-assisted code flooding production, and agents will only widen the gap between what we ship and what we can secure. Her framing — outpacing both attackers and our own agent-generated bugs — is correct, because security was always an arms race and AI just changed its tempo. What the post understates is incentives: nobody gets paid to patch decades of legacy software, so 'fixing 50 years of sloppiness' will likely require regulatory or procurement pressure, not goodwill. For founders, this doubles as a market signal — security tooling built for agent-era code review looks like one of the hottest categories ahead. Take it seriously; this isn't alarmism.