Greg Stanton, a security researcher at Wiz, asked an artificial intelligence agent in early August to test a security vulnerability he had found in WordPress on Drupal, another content management system. After eight hours, the agent reported that the attempt was unsuccessful. It then added that during testing, it had identified a vulnerability in PHP, the programming language both systems rely on.
Risks of Discovering Vulnerabilities
Stanton initially thought the AI agent had made a mistake. He says, "Models tend to hallucinate." However, this vulnerability, which had been exploited from a hidden flaw for over a decade, proved effective.
Read more: Iran and Russia are building a firewall similar to China's
While the Wiz team was unaware of this, researchers at another cybersecurity company called Calif, who were collaborating with OpenAI, had used AI to identify a related vulnerability. This indicates that when AI reaches a certain level of capability, it doesn't take long for long-standing weaknesses to be discovered. AI companies are trying to prevent this and provide early access to new AI models to defenders, including Wiz and Calif.
Impacts and Challenges
This event looks at a new stage in cybersecurity where AI helps defenders identify vulnerabilities, but they have less time to fix them. With the announcement of this vulnerability, concerns were raised about a "cyber apocalypse" that could plunge society into chaos. However, those who helped discover it are optimistic. Stanton says, "We are patching vulnerabilities at an unprecedented speed, and this helps overall security."
The Wiz team is facing new challenges. Tamer Schwartz, one of the co-founders and CTO at Wiz, says, "If this vulnerability had been disclosed a month before the patch was ready, we would have had a very different situation." He also notes that similar findings will soon increase, necessitating a review of all processes and methods.
Read more: Trump Administration Changes AI Terminology to Super Intelligence · Cyber Attacks to Exploit PHP Vulnerability Reached Millions
