Vicarius launches ScriptAI to write fixes for flaws with no vendor patch

Vicarius Inc., a vulnerability remediation company, has introduced ScriptAI, an AI engine capable of generating detection and remediation scripts for software flaws without a vendor patch. This solution addresses the gap between public disclosure and effective fixes. Zero Day Clock data from July 2024 revealed a mean time to exploit of just eight hours, compared to 53 days in 2024.

Vicarius attributes this capacity issue to the speed at which machines can identify exploitable code, as demonstrated by Anthropic PBC’s Claude Mythos and Google LLC’s Big Sleep agent. While the AI can write the scripts, Vicarius researchers review the logic before execution. The platform executes the script and confirms the outcome on affected machines within an hour, significantly faster than the weeks required for manual work.

The deterministic verdict is issued by a judge, devoid of the language model's influence. Each validated case is accompanied by a cryptographically signed evidence manifest, enabling customers to independently verify the results. Scripts follow a pre-check, apply the fix, verify it, and rollback if necessary to prevent breaking changes before reaching production.

Roi Cohen, co-founder and CEO of Vicarius, emphasized that AI should not only discover vulnerabilities but also assist in building protection. Previously, Vicarius launched vuln_GPT in August 2023, an AI model trained to write remediation scripts, which was made available for free through the company's vsociety community. ScriptAI's scripts operate natively as Bash and PowerShell at the operating system level, without additional agents or proprietary rule formats.

This adds ScriptAI as the fourth path in Vicarius's True Remediation strategy, which includes Patching, vShield protection, and vScript for custom and community-sourced remediation scripts. The new service is now available to vRx customers, with Vicarius building remediation tooling since 2016 from offices in New York and Tel Aviv. Bright Pixel Capital led a $30 million Series B funding round for the company in January 2024.