The AI-Discovered Bug That Could Have Become a Cybersecurity Disaster

In early August, Sagi Tzadik, a security researcher at Wiz, used an AI agent to probe whether a security flaw it had discovered in WordPress could also affect Drupal. After eight hours, the AI reported failure, but then revealed the discovery of a flaw in PHP, a programming language used by up to 70% of the web. Initially skeptical, Tzadik confirmed the exploit's validity.

Surprisingly, researchers at Calif also used AI to find a related flaw, demonstrating that AI can unearth long-standing weaknesses. This discovery marks a new era in cybersecurity, where AI aids defenders in finding vulnerabilities, but also presents greater risks. AI companies aim to provide early access to new models to defenders, but this time, it worked to their advantage.

The episode highlights the urgency of fixing vulnerabilities at an unprecedented pace. While the AI's discovery has sparked alarm of a potential "cyber-apolocalypse," the researchers involved view it positively, as vulnerabilities are being fixed faster than ever. However, the close call to disaster underscores how close the world came to chaos.

The vulnerabilities were disclosed online two days before the patch's release, causing widespread disruption. Even after the patch, many web pages, including those of government agencies and Wikipedia, faced temporary downtime. The cooperative effort between Calif and Wiz, driven by trust, paved the way for a fix. However, the increasing pace of AI discoveries will strain existing processes.

AI is invaluable in accelerating the discovery process, but the sheer number of vulnerabilities requires defenders to be vigilant and meticulous. Despite the challenges, AI remains a powerful tool in cybersecurity, enabling researchers to test hypotheses at an accelerated pace. The lesson is clear: cybersecurity demands a heightened focus, as AI offers both a head start and a headwind in the ongoing battle against cyber threats.