Over the past few months, it’s become clear that modern AI systems are quite adept at discovering software vulnerabilities and finding ways around cybersecurity defenses.

Unintended real-world breaches executed by models from leading AI companies like OpenAI and Anthropic during training exercises have drawn widespread concern, and while those companies have restricted access to their most capable models, experts have indicated it’s only a matter of time before less constrained AI systems have similar capabilities. Already, businesses are seeing a rise in cyberattacks, at least partly attributed to AI assistance.

And increasingly, the best defense lies in . . . artificial intelligence.

“We hear a lot about adversaries and attackers using it, and that’s certainly the case,” says Bartley Richardson, chief AI & autonomous systems officer at the cybersecurity firm CrowdStrike. “What we don’t hear as much about is how are we advantaging defenders with the use of AI.”

CrowdStrike is one of a number of cybersecurity businesses deploying AI on the defensive side. In September, the company announced a tool called SafeMind that purposely takes advantage of AI’s offensive capabilities, deploying custom models and harnesses designed to probe simulated versions of customer infrastructure. SafeMind also deploys defensive AI systems to detect the attacks, fend them off, and close any security holes that are discovered. Both sides then learn from the experience and try again, says Richardson.

“We not only make the changes in the environment before we give it back to the offense and say try again, but we also have a whole manifest—a whole log of every single change that we made to the environment,” he says. “We give that to the offensive harnesses as well.”

Such tools may be coming in the nick of time. Like AI coding systems, which have evolved from answering questions to generating, testing, and deploying complex code, AI hacking agents have become increasingly potent. They don’t just scour code for logic flaws but also probe live systems for vulnerabilities, potentially refining their attacks until they translate sets of subtle bugs into step-by-step pathways for unauthorized access.

“We are seeing a measurable increase in the volume and velocity of all of these attacks,” says David Cooper, cyberstrategy activation leader at EY, the big accounting and tech consulting firm. “We see it in our security telemetry clients, security operations centers—we’re seeing an uptick.”

Provided they aren’t detected and someone is willing to pay for the necessary computing power, they can work essentially indefatigably to find a way in to real-world systems, experts say. And they can find ways to chain together minor flaws in software to achieve ever-escalating access, devising complicated exploit processes that previously would have been found only by determined human experts.

‍

Read full article here