Last week I wrote that bug bounty is dead. Google suspended its open source program, curl and HackerOne pulled back, Intel dropped its cash rewards, and Microsoft shipped 966 patches in a single month. AI is finding vulnerabilities faster than any human team can confirm and fix them, and my answer was to let AI patch what AI finds, under rules leaders write in advance.
Several of you wrote back with the obvious next question. If we can never patch fast enough, why are we still writing so many bugs in the first place?
There is a serious answer to that question, and it has been sitting in a Cambridge lab since 2010.
What CHERI is
CHERI stands for Capability Hardware Enhanced RISC Instructions. It is a joint project of the University of Cambridge and SRI International, funded by DARPA since 2010, and its idea is simple to say and hard to build. Instead of trusting software to use memory correctly, it makes the processor enforce the rules.
On a conventional chip, a pointer is just a number, an address in memory. If a program gets that number wrong, through a bug or an attacker's trick, it can read or overwrite memory it was never meant to touch. That is how a large share of the most damaging exploits have worked for decades.
CHERI replaces those bare addresses with capabilities, hardware descriptions of exactly what a piece of code may touch and what it may do there. The processor checks every access. A program that tries to step outside its bounds simply stops, instead of handing an attacker the keys.
Two things it does
Memory protection for C and C++. These two languages run most of the world's operating systems, browsers, databases and devices, and they were never designed to be memory safe. The Cambridge team describes CHERI as giving these historically unsafe languages strong, compatible and efficient protection against many of the vulnerabilities attackers exploit most today. That matters because rewriting the world's C and C++ in a safer language is a project measured in decades.
Compartmentalization. CHERI also lets software be split into sealed compartments at a fine level. A flaw in one part of an application or operating system cannot reach the rest. Today's processors simply do not support isolation at that grain, so one bug in one component can still take down the whole system.
Why this matters more because of AI
This is where CHERI connects to last week. In Application Security in the Age of AI™, Volume VIII of The Operating Discipline for AI Library, I pointed to what the research shows about the code AI writes:
"A multi-language, multi-model study of generated code found that Python and Java outputs fared better than C and C++, which carried more memory safety defects, hardcoded secrets, and cryptographic misuse, and that models frequently failed to use security features already available in the toolchain (Kharma et al., 2025)."
So we have AI writing more C and C++ than ever, with more memory safety defects, while other AI finds those defects faster than humans can fix them. Patching harder does not win that race. Removing the class of bug does.
That is the shift in thinking. Last week's answer was to fix at machine speed. CHERI's answer is to make certain fixes unnecessary, because the hardware refuses to let the bug do harm.
Where it stands today
CHERI is not a paper idea. The team has built extensions for 64-bit RISC-V with Google, 32-bit RISC-V with Microsoft, and 64-bit Arm with Arm, along with formal models used to prove the security properties mathematically. The UK government has backed Arm's experimental Morello processor and board through its Digital Security by Design program since 2019. Since 2024 the UK has funded work to bring CHERI RISC-V processors to market across a range of sizes.
Just as important, CHERI was designed to be adopted gradually. It works alongside today's memory management and existing software, so organizations do not need to throw everything out at once. It has also been shown working under Java, JavaScript and Rust. CHERI has also crossed into commercial products. Microsoft has released CHERIoT Ibex, an embedded processor core whose security has been formally verified. Codasip sells the X730, a CHERI application processor, and SCI Semiconductor has released ICENI, a CHERI chip. Google is a founding member of the CHERI Alliance, the industry group working to make CHERI the standard for memory safety. None of this has replaced the processors in today's servers and laptops yet, but the hardware to make whole classes of memory bugs unexploitable now exists, can be licensed, and is moving into real products.
The project also lost one of its founders this year. Dr Peter Neumann, SRI International's lead on CHERI since 2010, died on May 17, 2026, after a research career of 73 years. Much of what makes this work possible traces back to people like him who spent decades arguing that security has to be designed in, not bolted on.
What leaders should do with this
Most executives will never buy a processor by instruction set, and that is fine. The leadership question is different: is your security strategy entirely about finding and fixing, or does any of it remove whole categories of risk?
This is where performative adoption shows up again. It is easy to buy another scanning tool, announce an AI security initiative, and keep running the same treadmill faster. It is much harder to ask your hardware vendors, your cloud providers and your device suppliers what they are doing about memory safety, and to make that answer part of how you buy.
Three questions worth putting on your next vendor review:
Which of your products are written in C or C++, and what is your plan for memory safety?
Do you use hardware memory protection anywhere today, including CHERI-based designs, and where is it on your roadmap?
If one component is compromised, what stops the flaw from reaching the rest of the system?
The answers will tell you which vendors are still racing the patch queue and which ones are working to shrink it.
Bug bounty died because we were trying to out-patch machines. The long-term answer is to stop writing the bugs machines are best at finding. CHERI is the most serious attempt yet to do exactly that, and I am now tracking its development on theworldofai.org.