The AI-Discovered Bug That Could Have Become a Cybersecurity Disaster
In early August, Sagi Tzadik asked an AI agent to take a security flaw it had found in WordPress and see whether the same weakness could be made to work against Drupal, another popular content management system. Eight hours later, the agent reported that it had failed. Then it added that, in the course of trying, it found a flaw in PHP, the programming language on which both systems—and as much as 70% of the web—depend.
TL;DR
- An AI agent, tasked with testing a WordPress security flaw against Drupal, instead discovered a long-standing vulnerability in the PHP programming language.
- Cybersecurity firms Wiz and Calif collaborated with PHP maintainers to develop and release a patch for the vulnerability ahead of schedule.
- Despite the rapid response, details of the vulnerability leaked online, resulting in millions of exploit attempts before the patch was widely deployed.
- AI is significantly speeding up the process of finding security vulnerabilities, condensing months of traditional research into hours or days.
- The speed of AI-driven vulnerability discovery necessitates a rethinking of cybersecurity processes and a faster response to potential threats.
- While AI helps defenders find bugs faster, attackers only need to succeed once, creating a persistent challenge for cybersecurity.
- The cost of using AI for bug discovery can be substantial, with one organization spending around $1 million.