AI Is Finding Security Flaws Faster Than Volunteers Can Fix Them, Researchers Warn

Earlier this month, authorities worldwide urged website administrators to run emergency updates after a nonprofit programming foundation flagged critical security flaws that could let hackers breach systems. Government and corporate websites briefly went offline to patch the vulnerabilities, which were discovered by independent cybersecurity experts using artificial intelligence.

The flaws had sat unnoticed in the code of PHP, a widely used open-source web programming language, for more than a decade. They were too complicated for humans to exploit without advanced AI. Cybersecurity experts and software maintainers say this could be the first of many security flaws exposed by emerging AI - and much of the world's critical digital infrastructure is maintained by volunteers who lack the resources and time to respond.

"There's been a lot of people in the AI safety community that said this is one of the first areas where we are going to see the harmful impact of AI," said Peter Slattery, a research scientist at MIT's FutureTech, who studies how cybersecurity experts are dealing with the new technology and tracks real-world incidents involving AI.

PHP began in 1995, when Danish-Canadian programmer Rasmus Lerdorf sought to track visitors to his online resume. Others around the world improved the software, and it grew in popularity. Websites like Facebook and Wikipedia were built using PHP, which runs about 70 percent of the world's websites. In 2021, a dedicated nonprofit, the PHP Foundation, was launched to coordinate development. Like many foundations maintaining open-source software, it operates on a meagre budget.

Most of the digital infrastructure consumers use is powered by open-source software - the Mozilla Firefox browser, languages like Perl, Python and JavaScript, and servers running products like Apache HTTP Server, maintained by the Apache Software Foundation. "The world today, including proprietary software vendors, relies on open source software for its digital infrastructure," said Amanda Brock, CEO of OpenUK, a nonprofit that supports open-source software.

The world's largest corporations, like Meta, Google, OpenAI and Anthropic, depend on that volunteer-built infrastructure. Now their own AI tools are uncovering security flaws at a pace that needs far more resources for groups like the PHP Foundation to keep up. "It's simply not possible with the resources in place to fix all of the known vulnerabilities," Brock said. "Foundations are attempting to manage these challenges, but the smaller ones don't have hundreds of millions in funding, and managing this at the pace AI requires is proving impossible."

The PHP flaws were found through several advanced AI models, which can attempt far more complicated hacks than humans could. Other software developers are also discovering far more security flaws because AI is being used to probe defences. Google said it uncovered more than 1,000 security bugs in the last update for its Chrome browser, more than in the last two dozen updates combined. Mozilla, the foundation behind Firefox, found more than 400 security vulnerabilities in April, a significant jump from the previous record of 76 bugs discovered just one month earlier.

"We have maybe 10 times more issues than usual because we are using AI to find them," said Jarek Potiuk, part of the volunteer security team at the Apache Software Foundation. (In keeping with the foundation's non-hierarchical ethos, Potiuk said he has no real title.) Potiuk said there is an "industry-wide movement" to conduct scans using AI models to identify vulnerabilities, much like was done to find the bugs in PHP. But the scans themselves cost money - used to pay for the tokens for AI models - and afterwards, humans must pore over them to weed out false positives. "Every project, every foundation is doing this right now - spending enormous amounts of time to find these issues," Potiuk said. "AI helps to find them, but you have to verify things, you have to review them."

Earlier this year, Anthropic launched Project Glasswing, offering $100m in credits to support its advanced Claude Mythos AI model to search for security vulnerabilities in the world's critical software. In one month, more than 23,000 vulnerabilities were found across more than 1,000 open-source projects. The Apache Software Foundation has taken advantage of another scheme, the Alpha-Omega project, to scan for security bugs across the 290 software packages it maintains. The project, backed by companies like Anthropic, Amazon, Google, Microsoft and OpenAI, spends about $7m a year helping open-source developers find critical security bugs.

But those working on finding and fixing the flaws say the corporate world could be doing a lot more, given the trillion-dollar valuation of companies whose products would not work without free software like the packages the Apache Foundation provides. "They are helping a lot, but we need more active players in this area," Potiuk said, "because it's highly disproportional - the impact it has on the corporate world versus the open source world." When a major flaw is uncovered, it often comes down to a handful of volunteers to fix it.

Keeping the internet's infrastructure as decentralised and open-source as possible is crucial, Potiuk said. Instead of buying out something like PHP, major players like Google or Microsoft could, for instance, pay staff to dedicate some of their work hours to maintaining open-source projects they use.

The 2021 Log4Shell vulnerability, which allowed hackers to remotely run code on millions of devices through a widely used library maintained by the Apache Software Foundation, underscored the critical role open-source software plays in system security. That bug was discovered without the use of AI. Suddenly, cars, microwaves and a host of electronic devices connected to the internet were vulnerable, Potiuk said. "That was the moment when the whole ecosystem realised how important it is to take care of open source," he said. A bug like that, if found by a malicious hacker and exploited before there is a chance to patch devices, could have caused a major disruption.

Slattery said the database of incidents he and his colleagues maintain shows that an increasing number of vulnerabilities are being detected, and it is a matter of time before some are exploited in the real world. "We are starting to see both a lot more vulnerabilities detected and addressed in time, but also attacks on a wide range of systems," Slattery said. "We have been moving in this direction for a long time. There are more and more things now you can attack."

Source: Al Jazeera