At this point, I'm going to say you're retarded if you aren't at a minimum running your safety critical software through various AI models before official release. It seems like a duty to know what is popular and likely being used to find exploits, and to use it against yourself first and continuously.

All this bullshit also reminds me of an undergrad class I had on validation and verification of software input and output. Maybe we should be testing assumptions? For example, that generated key output isn't trivial to guess? Surely there's a way to generate and test data prior to release.

Subject to change if someone convinces me otherwise, but that's where my thinking is.