Oracle Overhauls Database Security as Frontier AI Flaw-Hunting Expands Patch Cycles

Frontier artificial intelligence models capable of identifying software flaws by the hundreds are forcing enterprise software vendors to sharply expand their patch cycles, according to Juan Loaiza, executive vice president of Oracle Database Technologies. Speaking at the Oracle AI World conference, Loaiza outlined how Oracle Corp. is combining automated workload testing with a structural shift that moves application security controls directly into the database engine.

The response began after Oracle secured early access in March to an advanced AI model called Mythos and pointed it at the company's proprietary code, Loaiza said during an interview with theCUBE, SiliconANGLE Media's livestreaming studio, as reported by SiliconANGLE. The model uncovered a wave of severe vulnerabilities, triggering an internal crisis response across engineering teams.

The resulting fixes have dramatically inflated the vendor's standard maintenance cycles. A single quarterly security update issued earlier this year resolved more than 1,400 vulnerabilities across Oracle's product portfolio. However, shipping massive updates into mission-critical production environments carries severe regression risks. To avoid taking down production systems, Oracle is using its Real Application Testing tool to capture real-world customer workloads and replay them against patched environments before administrators deploy the software.

Beyond remediating discovered vulnerabilities, the expansion of AI-generated software and autonomous agents has undermined traditional application-layer protections. Enterprise business software historically relied on application code to enforce user identity and business rules, such as preventing a transaction that exceeds an account limit. Because autonomous agents can query underlying data stores directly or generate novel query paths, middle-tier logic can be bypassed entirely.

Oracle began addressing that architectural shift in April with the release of Deep Data Security, which passes an authenticated user's identity directly to the database as an encrypted token. Under this model, an AI agent operating on a user's behalf is bound by that specific user's database permissions and cannot inspect or leak restricted records. Oracle has since expanded those authorization controls across remote databases, data lakehouses, and related tables.

To enforce transactional logic, the company is introducing declarative policies and SQL Assertions that validate state changes inside the storage layer itself. By locking business rules into the data engine rather than application code, the database rejects prohibited operations regardless of whether a command originates from traditional software or an autonomous agent.

As enterprises increasingly deploy autonomous agents against core operational records, administrators face a compounding operational mandate: deploying record-sized security updates without service interruption while re-architecting legacy application permissions into native database schemas.