Project Glasswing - AI Discovers Vulnerabilities, Who Fixes Them?

What Happened

Last week, Anthropic unveiled Project Glasswing, an AI model that excels at discovering software vulnerabilities. This model is so effective that Anthropic decided to postpone its public release. Instead, it has granted access to major tech companies like Apple, Microsoft, Google, and Amazon to identify and patch vulnerabilities before adversaries can exploit them.

The Discovery

The Mythos Preview model, which led to Project Glasswing, uncovered vulnerabilities across all major operating systems and browsers. Some of these bugs had evaded detection for decades, including one that had been dormant in OpenBSD for 27 years. Notably, Mythos didn’t just identify single vulnerabilities; it successfully chained multiple bugs into complex exploit sequences, demonstrating a high success rate in testing environments.

The Cybersecurity Gap

A staggering statistic emerged: fewer than 1% of the vulnerabilities discovered by Mythos were patched. This highlights a significant gap in the cybersecurity ecosystem. While AI can effectively find vulnerabilities, the industry struggles to address them in a timely manner. Security teams operate on a slower calendar speed, while attackers are increasingly leveraging AI to move at machine speed.

Why Defenders Can't Keep Up

The traditional approach to cybersecurity involves gathering intelligence, simulating threats, and mitigating them, which can take days. In contrast, attackers are now using AI to automate their processes, resulting in rapid exploit development. For instance, a recent attack against FortiGate appliances involved an AI that autonomously created backdoors and conducted vulnerability assessments, compromising over 2,500 organizations worldwide.

The Need for Change

With the speed at which vulnerabilities are discovered, organizations must rethink their security programs. The focus should shift from merely finding bugs to efficiently processing and remediating them. This requires a shift in mindset about how vulnerabilities are prioritized and addressed.

Building a Mythos-Ready Security Program

To effectively manage the influx of vulnerabilities from AI models like Mythos, organizations should consider three key strategies:

1. Signal-Driven Validation: Instead of scheduled testing, defenses need to be tested immediately when new threats emerge or when changes occur in the environment.
2. Environment-Specific Context: Prioritization should not rely solely on generic CVSS scores but should consider the specific context of the organization’s infrastructure.
3. Closed-Loop Remediation: The remediation process must be automated to eliminate manual handoffs, ensuring that vulnerabilities are addressed swiftly.

Conclusion

Project Glasswing has proven that AI can revolutionize vulnerability discovery, but it also exposes a critical challenge: the ability to patch vulnerabilities before they are exploited. The future of cybersecurity will depend on how effectively organizations can adapt to this new reality, ensuring that they not only find vulnerabilities but also remediate them in a timely manner.