AI-driven bug discovery threatens to accelerate cyberattacks

A surge in hidden flaws

Advances in artificial intelligence are uncovering a massive stream of new software vulnerabilities. According to research from the threat intelligence firm VulnCheck, AI has helped drive a doubling of the number of digital flaws discovered year-on-year.

These flaws are often hidden deep within the fabric of the internet, where they may sit for years without being noticed. Experts warn that these newly discovered weaknesses are almost certain to trigger more disruptions, similar to the outages seen across global government websites recently.

The sheer volume of these discoveries is creating a high-pressure environment for cybersecurity professionals. As more bugs come to light, the industry is preparing for a period where it may feel like the sky is falling every week as critical software is audited.

The PHP vulnerability case

A recent example of this risk involved a vulnerability in PHP, a long-standing programming language that powers a large portion of the web. The discovery of this weakness caused a scramble among operators to secure their systems before hackers could exploit them.

Because some organizations felt they could not patch the software quickly enough, they chose to yank their websites offline entirely. This proactive move was intended to keep the data safe while developers worked on a permanent fix for the flaw.

As reported by Global Banking & Finance Review, this specific incident occurred during an already busy week for the cybersecurity community. Other vulnerabilities were disclosed simultaneously in platforms like Node.js and Plex, highlighting a trend of rapid-fire security disclosures.

Shortening the exploit window

In the past, finding a bug required significant human skill, and turning that bug into a functional digital lockpick, known as an exploit, could take weeks or months. This gave defenders a reasonable amount of breathing room to test and roll out software updates safely.

AI has fundamentally changed this timeline by subjecting codebases to round-the-clock scrutiny. These models can identify flaws and turn them into usable exploits in a matter of hours, effectively removing the buffer for security teams.

The chief technology officer of RunSafe Security noted that the demonstrated performance of AI models has removed any doubt about this shift. The primary change is the timescale for how quickly adversaries can weaponize a newly discovered vulnerability.

Debate over attack success

While the speed of discovery is increasing, experts are split on whether this will lead to a hacker free-for-all. Some argue that the bugs found by AI models are often exotic and difficult for rogue actors to actually use in a successful attack.

For instance, during the PHP vulnerability incident, threat intelligence firms observed aggressive attempts to exploit the flaw. However, researchers noted that cybercriminals appeared to fail in cobbling together a working tool to take advantage of it by the following day.

The consensus among some professionals is that more disclosed vulnerabilities do not automatically equate to more successful attacks. The complexity of the software may still act as a barrier even if the initial discovery is automated by AI.

The long-term outlook

Despite the immediate risks of outages and disruptions, some industry leaders view the AI-driven deluge of bugs as a net positive. They compare the process to slaying monsters in a haunted house, where the goal is to find and eliminate threats rather than letting them lurk in the dark.

The argument is that while the constant cycle of discovery and patching is stressful, it is better than leaving vulnerabilities hidden. By using AI to find these flaws, the industry can systematically clean up the internet's underlying infrastructure.

Cloudflare's CEO suggested that while the next few years will be busy, the reality is that this process will eventually lead to a cleaner digital environment. The goal is to ensure that software is hardened against threats before they can be used maliciously.