On the 4th of November, OpenAI released a paper titled 'A Thousand Fewer Paths to Root'. This paper focuses on using AI to find vulnerabilities at scale on the kernel. The main question this paper addresses is whether AI can be used to automate some aspects of vulnerability research which usually requires high level of knowledge and manual effort.
The Process Scout agents were used to find areas of the kernel that are relevant to security. Analyst agents were used to find potential vulnerabilities. Other agents were used to reproduce the findings within isolated virtual machines. These agents also assessed exploitability and created potential patches.
The Results 2308 potential findings. 1724 vulnerabilities were reproduced. 948 unique local privilege escalation exploits that could have allowed an unprivileged user to become root.
This main campaign cost around $1.2 million in API credits. Although this is a large amount, it shows that research is being done at scale.
What I learnt As a computer science student, I am interested in software development and security. What I have learnt from this is that understanding code is no longer enough. We now also need to understand how code can fail, how vulnerabilities can be exploited and how systems can be made more resilient. AI will become an important tool to security researchers. Secure coding, vulnerability management and defensive security will become more important than ever. The future of cybersecurity will be about constantly testing, challenging and improving secure code.
Paper: https://openai.com/index/a-thousand-fewer-paths-to-root/