Researcher Warns Vulnerability 'Flood' Is Coming as Athena Disclosures Begin

A security researcher has warned that the industry is unprepared for a surge of vulnerability findings from AI models, as his organization prepares to begin publishing results from its Athena project this month. In a post responding to Dario Amodei's essay "We Must Pace the Frontier," he said the gap between what models can do and what organizations are ready for has grown since May.

Athena has received more than 40,000 findings since June, 42% rated critical or high, across over 500 projects, with more than 2,000 patches produced. Disclosure begins September 28 with about 50 findings, all low-stakes silent fixes - bugs already fixed at head but never assigned a CVE. The organization is also becoming a CVE Numbering Authority in partnership with CISA, scoped to open source flaws processed through Athena.

The researcher said joining Anthropic's Project Glasswing gave Athena access to the Mythos model. In one six-hour run against a heavily tested open source project, it produced more than a dozen validated pre-authentication remote code execution vulnerabilities, each reproduced three times in a clean virtual machine. "A model found all of it in an afternoon," he wrote.

He described two clocks racing: the industry absorbing a rush of findings through disclosure processes already behind, and attacker capability advancing toward cheap compromise of critical infrastructure. The second is running faster, he said.

His conclusion: faster disclosure only helps those who can act on it. "The flood is coming, and the pipes were already full," he wrote, arguing the endgame is a stack built secure by construction rather than patching an architecture.

Source: The Hackers News