Black Hat USA 2026: AI-driven vulnerability discovery outpaces reporting and patching, straining responsible disclosure
A keynote at Black Hat USA 2026 by associate professor Yan Shoshitaishvili and his undergraduate students at Arizona State University examined the growing use of AI models for vulnerability discovery. The team used the 479 Linux kernel vulnerabilities attributed to Anthropic's Claude Mythos (as reported by the Washington Post) as a benchmark. Through workflow integration and training on known vulnerability properties, their GPT-based setup reached roughly 1,000 findings, faster than they could produce detailed reports and proposed fixes. The article argues this scale strains responsible disclosure and patch management, with a risk of more unpatched software or untested patching. The author closes with an optimistic view that discovery may eventually peak as legacy code is exhausted and AI-assisted development reduces new flaws.
Detalhes técnicos
- Earlier GPT models found about 300 Linux kernel flaws. Adding Mythos-like workflows to three GPTs raised this to about 600, and training on known vulnerability properties raised it to about 1,000.
- The bottleneck was reporting, meaning detailed research and proposed fixes, not discovery.
- Microsoft Patch Tuesday volumes cited: 169 CVEs in April, 118 in May, 571 in June (208 direct Microsoft CVEs) and 622 in July, including zero-days under active exploitation.
- The US government created a vulnerability clearing house named Gold Eagle to coordinate discovery, mitigation and fixes.
Remediação
The article gives no specific remediation. It warns that rushed patching without testing can cause compatibility issues, and that delayed patching gives cybercriminals more opportunities.
Linha do tempo
-
Black Hat USA 2026: AI-driven vulnerability discovery outpaces reporting and patching, straining responsible disclosure
ler a análise desta fonte ocultar
A keynote at Black Hat USA 2026 by associate professor Yan Shoshitaishvili and his undergraduate students at Arizona State University examined the growing use of AI models for vulnerability discovery. The team used the 479 Linux kernel vulnerabilities attributed to Anthropic's Claude Mythos (as reported by the Washington Post) as a benchmark. Through workflow integration and training on known vulnerability properties, their GPT-based setup reached roughly 1,000 findings, faster than they could produce detailed reports and proposed fixes. The article argues this scale strains responsible disclosure and patch management, with a risk of more unpatched software or untested patching. The author closes with an optimistic view that discovery may eventually peak as legacy code is exhausted and AI-assisted development reduces new flaws.
Technical Details
- Earlier GPT models found about 300 Linux kernel flaws. Adding Mythos-like workflows to three GPTs raised this to about 600, and training on known vulnerability properties raised it to about 1,000.
- The bottleneck was reporting, meaning detailed research and proposed fixes, not discovery.
- Microsoft Patch Tuesday volumes cited: 169 CVEs in April, 118 in May, 571 in June (208 direct Microsoft CVEs) and 622 in July, including zero-days under active exploitation.
- The US government created a vulnerability clearing house named Gold Eagle to coordinate discovery, mitigation and fixes.
Remediation
The article gives no specific remediation. It warns that rushed patching without testing can cause compatibility issues, and that delayed patching gives cybercriminals more opportunities.