An analysis of AI-driven exploitation and AI-driven patching: how cheap exploits create pressure for autonomous fixes, the new failure modes autonomous patching brings, what regulation like the EU Cyber Resilience Act expects, and a practical model for deciding how much a patching agent may do without a human.