> LLMs with coding abilities could be employed to create sophisticated malware with unprecedented ease. If that is possible then shouldn't it also be possible to ask the AI to find and code remediation to the vulnerabilities it found? So AI could be used to find all possible code-vulnerabilities and then how to neutralize those? This would advance software security in general. In other words AI could be used like a m…
It might be that finding vulnerabilities is easier than fixing them (think AI-driven fuzz testing).
Right, it is probably us humans that will have to fix the vulnerabilities :-)
Malware has to find one flaw. Bene-ware has to avoid screwing up of any one of thousands (millions) of calls in a system. 'Undocumented but valid' is also a nightmare here. Recently the software I support broke for a bunch of clients in the field because they were using an undocumented method that worked, but that we did not actually test internally. This did come a surprise to our testing and development team as our…
If hackers can use AI to find the vulnerabilities then surely the good guys can find the same vulnerabilities with the same AI. And once you are aware of them you can protect against them. I don't think the bad guys have any special advantage that would allow them to produce AI better than the good guys. Hackers are good at finding vulnerabilities because as you say they only need to find one vulnerability. But you c…
I work in the vuln finding/remediation industry and we have tooling that finds holes and tells the users to fix them, and the users don't. Maybe giving AI access to the code to scan, exploit, develop a fix for, push to dev, run QA tests on, then push to production might help, but that is a much bigger, more energy intensive, more expensive, and easier to break chain than an AI just just finds exploits and dumps out exploit code.