Security researcher Chris Domas joined David Bombal at Black Hat USA 2026 to reveal how legal compiler optimizations can strip away security protections from seemingly secure code. The discussion centered on the discrepancy between source code and compiled binaries, demonstrating that the CPU executes compiler output, not source. Key points included how compilers delete memory-clearing operations and introduce time-of-check to time-of-use vulnerabilities.

A specific example showed that 17 or 33 bytes can be safe, while nearby sizes are vulnerable. The researchers debated whether Rust solves the problem and why switching between GCC and Clang offers no guarantee of safety. David highlighted that AI analysis of 500 million lines of open-source code identified 300 dangerous patterns.

Crucially, developers were advised to enable compiler warnings, use sanitizers, analyze optimized builds, and test the exact binary shipped, rather than relying on source code review alone. The session warned that legal transformations make source-level security insufficient, urging a shift toward binary-level verification for robust defense.