Although defenders are being given a head begin, they face a drawback of one other type. Attackers solely need to succeed as soon as. “However, as defenders, we have to be sure that each single vulnerability is roofed,” Schwartz says.
AI helps defenders discover these vulnerabilities first. Beforehand, testing suspected bugs might take weeks, forcing researchers to prioritize which have been most promising. However now AI brokers permit researchers to check many concepts without delay, Tzadik says. “It’s months of conventional analysis condensed to, like, days—couple hours to days, actually.”
However even with AI, the method is labor intensive. After the agent helped Wiz uncover the PHP vulnerability, it nonetheless couldn’t describe how the bug labored, Tzadik says. Its explanations have been “simply slop.” He and colleagues spent days untangling the reason for a bug and ultimately reproducing it.
Value is one other constraint. Joshua Saxe, Meta’s former AI safety tech lead, who left in February to co-found Abundance Safety says he’s working with a corporation that has spent roughly $1 million utilizing Anthropic’s Mythos to establish bugs, including that extra bugs stay.
Discussion about this post