The verification asymmetry
Offense asks 'does a bug exist?' Defense asks 'are all bugs gone?' The first is an existential claim you can check with one example. The second is a universal claim you cannot fully check. This difference determines where AI agents work in security more than model capability does.