AI-Found Bugs Aren't Proving Any Easier to Exploit Despite the Hype
- Reference: 0184740050
- News link: https://it.slashdot.org/story/26/07/28/212240/ai-found-bugs-arent-proving-any-easier-to-exploit-despite-the-hype
- Source link:
> The report takes particular aim at Anthropic's much-publicized Project Glasswing, unveiled in April with warnings that AI-assisted vulnerability discovery could allow attackers to hijack systems, disrupt operations, or steal data. Claude Mythos may have identified 23,019 vulnerability candidates, but there's remarkably little public evidence showing what became of most of them. VulnCheck notes that only 126 have been published as CVEs, that just one has been confirmed exploited in the wild, and that Anthropic's public disclosure record has seen little movement since Project Glasswing launched.
>
> But that doesn't mean AI-assisted vulnerability research has failed, according to Patrick Garrity, security researcher at VulnCheck. "AI-assisted vulnerability discovery clearly has value for both attackers and defenders," Garrity wrote. "The data does not suggest that AI-discovered vulnerabilities are inherently more likely to be exploited than those found through traditional methods." Instead, he argues, AI is simply helping researchers discover more flaws, giving defenders an opportunity to patch them before criminals get there.
>
> Garrity stopped well short of declaring the threat overblown forever, but he did suggest some of the rhetoric has outpaced reality. "The data so far, including Anthropic's own stalled disclosure ledger, suggests that AI-assisted vulnerability discovery and frontier capabilities have been overhyped relative to the evidence available today," he wrote. "That doesn't mean the risk is imaginary. It means the impact has been real but modest."
[1] https://www.theregister.com/security/2026/07/28/ai-found-bugs-arent-proving-any-easier-to-exploit-despite-the-hype/5279637
Sunshine is the best disinfectant (Score:2)
The end result of all of this AI vulnerability discovery will be more secure patched or replaced code all over the place, right?
Short term pain for eventual gain.
I guess at some point it will be considered malpractice to release your software product/service without having its code scanned by powerful AI vulnerability checker, right?
Hey, maybe this will even drive someone to invent a language as secure as Rust but only 1/3 as weird and complex to use.
Re: (Score:2)
Not really. It may force some people to actually start taking software security seriously, but the rest will continue to push out crappy insecure code because that is much cheaper. What we really need is liability, not AI. Especially as AI is pretty bad at finding vulnerabilities in the sense that it does not find a lot of stuff that humans find obvious to find.
Re: (Score:2)
It's... complicated.
AI vulnerability discovery will lead to more secure code in the projects that are using it heavily . Mostly that means the projects that were already taking security very seriously, like operating systems and web browsers. They should get more secure.
Other projects that don't take security seriously will continue to be insecure. The thousands of applications, WordPress plugins, JavaScript libraries, etc. that people blindly install and trust to be secure even though they aren't.
And the
AI is not Sunshine ... (Score:2)
> Sunshine is the best disinfectant
AIs are not sunshine. Their models are black boxes where we have no idea what they are doing, or why. For all we know they are intentionally not reporting the more exploitable bugs.
If you're paying attention you know why (Score:2)
AI is finding bugs in places that nobody is bothering to look. It's not that they're not looking it's that they're not bothering because they already know that if there is a bug over there it's not going to affect anything and it would be a waste of their time to go hunting for it.
Security researchers are actually smart, who knew? So they know where to allocate their time to find the most exploitable bugs. AI on the other hand has all the time in the universe as long as we're willing to keep giving it r
Re: (Score:3)
Note that while it notes that over 98% of "discoveries" seem to not be exploited, it also notes this is the rate for the pre-AI world as well.
Which is consistent with my experience with security "findings", very poor signal to noise ratio. At least in my time with the security industry, it's always hard to know whether to take something seriously, as they keep coming up with duds and claim victory. They tend to be eternally in "the sky is falling" mode, and sometimes it is very much falling, but most of t
Re: (Score:2)
It is a problem, agreed. On the other hand, if you require working exploit code that is just bad in the other direction.
My take is that the whole "vulnerability finding" approach is essentially the worst way of doing it and it does not really work. Instead resilience, redundancy, defense in depth, etc. would need to be done and then most exploitability goes away and you just have the occasional DoS vulnerability. But that cost money and software is still routinely done cheaper-than-possible and with barely
It's not just about whether it's exploited (Score:2)
It's about how difficult it is to exploit it. If an exploit requires half a dozen other things to go wrong first then it's probably not a major issue. A human being would consider those half-dozen things and say it's not worth the effort to track down and fix a potential exploit behind them. An AI would just full steam ahead and find it.
Human beings prioritize things differently than AI.
Re: (Score:2)
Maybe you didn't know that a successful exploit often goes undetected? Even if there is no escalation in the rate of exploits currently (something that, again, we can't know), this in no way assures that as AI improves, and hackers get better at leveraging it, we won't see an escalation. As more CVEs are found there will be more low hanging fruit. It really blows my mind that people run around talking like they are experts on this subject when they clearly have no idea what they are talking about. Much s
Re: (Score:2)
Well, AI is certainly find stuff that nobody bothered to try to find. As to the explanation, that depends.
Yes, AI is flagging a lot of non-exploitable stuff and a lot of stuff where the devs _know_ it is not exploitable. That just comes form AI not having any insight whatsoever and a very limited view in the first place due to much too small token windows to do anything a bit more complex.
But there is also that AI finds vulnerabilities where the devs screwed up by not even using basic tools and techniques a
Re: (Score:2)
> "AI is finding bugs in places that nobody is bothering to look. It's not that they're not looking it's that they're not bothering because they already know that if there is a bug over there it's not going to affect anything and it would be a waste of their time to go hunting for it."
Are you completely unaware of what is happening in Linux kernel development right now?
"Recent Linux kernel vulnerability activity shows a sharp rise in deep, long-standing root-escalation bugs found or accelerated by artifici
And? (Score:4, Insightful)
The most sophisticated hacks link together several small vulnerabilities before they ultimately break security. Just because it cannot be exploited on it's own doesn't mean it cannot be used as part of an exploit chain.
Re: (Score:2)
And that is an excellent point.
Re: (Score:2)
> The most sophisticated hacks link together several small vulnerabilities before they ultimately break security. Just because it cannot be exploited on it's own doesn't mean it cannot be used as part of an exploit chain.
Yeah, I think what we're seeing here is that attackers are resource-constrained, and that the hard part of creating an exploit isn't finding the vulns (there are tons of them), but figuring out how to turn the vulns into a working exploit chain. Merely having more fodder for crafting exploit chains doesn't necessarily make them easier to build... and keep in mind that the vast majority of attackers are glorified script kiddies. So the small number of really capable black hats may not have seen much benefi
Government based attackers (Score:3)
The AI bug finder is not particularly helpful to most criminals. It is a relatively expensive way to find lots of small bugs.
But if a nation state decides to invest a few 100 million dollars, it can find enough of these things to plan a cyber assault around them.
That is the real fear from AI bug finding.
Re: (Score:2)
> " It is a relatively expensive way to find lots of small bugs."
Actually, it [1]doesn't cost them a much at all [cisa.gov]. And AI can already create exploits. I agree that script kiddies won't be doing it, but you don't need to be an APT / Nation State actor anymore either. What's more, the bar is getting lower all the time. The biggest fear of AI bug finding is that so many people have their head in the sand. This is reminiscent of the Y2K problem. If things don't get way out of hand it will be because enough intell
[1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Dumb question: Could you train on these "bugs" (Score:1)
Could you train on these bugs and the code they are in to train a coding AI to avoid creating them? Or to improve finding existing bugs?
I think that was not the claim (Score:2)
The claim, as I read it, is that
a) LLMs can write (crappy, but that works) exploit code much, much faster. For vulnerabilities found in any way. We have seen that several times in practice with attack code made from patches.
b) LLMs can find some vulnerabilities that have evaded humans, but not that many or not that hard to find ones. And they deliver lots of potential vulnerabilities with low-quality analyses and tons of non-obvious false positives.
Now, that said, why are we not seeing any great surge of ac
Still needs to be fixed (Score:3)
They still need to be fixed.
thanks for the info (Score:2)
> VulnCheck found that only 14 of 1,061 attributed discoveries, or 1.3 percent, had been exploited, which is "almost identical to the rate across all vulnerabilities in VulnCheck's dataset,"
which makes sense, as does the fact that if there are more discoveries (through llm) there will be proportionally more exploits (surfaced or not). so the news seems to be that the hype was just hype but there is still a reasonable concern ... who would have thunk!
sshhhh, Seymour (Score:1)
must feed the bubble
Re: (Score:2, Insightful)
You are anthropomorphizing a computer program, and attributing super-human powers to it to boot ... which is exactly what the AI companies want!
An AI is no different from (say) Microsoft Word: it does not have magic powers. It is good at putting together chains of actions and of finding vulnerabilities, and when IRRESPONSIBLY LEFT TO RUN WITH THE RIGHT PROMPT AND NO VIRTUALIZATION OR OTHER ISOLATION ... it can "run rogue" ... the same way Word's spell checker can run rogue if you just auto click accept, ev
Re: (Score:2)
The hell it hasnt... [1]https://github.com/ctrl-adam/DocSec [github.com]
[1] https://github.com/ctrl-adam/DocSec
Re: (Score:2)
That has to be one of the most clueless posts I have seen about AI in 2026 here on Slashdot, and that is saying a *lot*.
> "An AI is no different from (say) Microsoft Word"
AI is completely different from Word. Word is a program that is deterministic. AI is software that models neurons. While there is some programming glue, at its core it is *trained* not programmed. Seriously, until you get at least a basic understanding of AI stop thinking you understand it, because you definitely don't.
> "There's zero agency"
Re: Meanwhile... (Score:2)
Trained huh? So, an AI can train another AI and things will continue to get better and learn new things, right? You know... Like humans do?
Re: (Score:2)
> Trained huh? So, an AI can train another AI and things will continue to get better and learn new things, right? You know... Like humans do?"
Yes. In the future you should probably get a basic education on the subject before getting smarmy and making yourself look like a fool.
Re: Meanwhile... (Score:2)
No no, that one is clearly real!