Tag
Google points out that relying solely on large language models in vulnerability mining is not enough; the key is to combine an agent-based vulnerability discovery framework. For example, its team used this tool to discover multiple critical vulnerabilities in a short time.
Zhipu AI released GLM-5.3, significantly enhancing programming and cybersecurity capabilities through post-training reinforcement learning, becoming the top open-source model for programming, and unexpectedly discovering numerous real vulnerabilities.
Zhipu releases flagship AI model GLM-5.3, achieving major breakthroughs in programming and cybersecurity vulnerability detection, aiming to challenge leading enterprises like Anthropic and OpenAI.
Announcement of a DEF CON talk by @clearbluejar on hands-on vulnerability discovery using local AI models.
Google is using AI and LLMs to automate Chrome vulnerability discovery, triage, and patching, resulting in more bugs fixed in June than in the past two years, including a 13-year-old sandbox escape.
Google reports that AI tools helped it fix 1,072 security bugs in Chrome during June 2026, more than in the previous two years combined, highlighting the shift toward automated vulnerability discovery.
Anthropic's Mythos AI model has been uncovering critical and important bugs in Microsoft's SharePoint and other software at a rate that outstrips Microsoft's ability to patch them, raising urgent security concerns about adversaries exploiting the same vulnerabilities.
Google DeepMind introduces Gemini 3.5 Flash Cyber, a lightweight cybersecurity model fine-tuned for vulnerability discovery and patching, with a limited-access pilot for governments and trusted partners.
This paper presents a practical evaluation protocol for assessing AI pentesting agents in realistic, complex targets rather than simplified benchmarks. It uses LLM-based semantic matching, bipartite resolution, and continuous ground-truth to score vulnerabilities discovered, and releases expert-annotated ground truth and code.
This paper examines how the EU Cyber Resilience Act's assumptions about human-paced vulnerability management may be undermined by increasingly capable AI agents, identifying which parts of the regulation remain robust and which may face pressure.
Proposes SAGE, a framework for autonomously uncovering latent failure patterns in LLM-based Text-to-SQL generation by generating vulnerability hypotheses and iteratively verifying them. Experiments show SAGE reveals significant model fragility and discovered patterns transfer across models, with preliminary fine-tuning showing promising remediation.
This research paper proposes a transformer-based reinforcement learning framework to automatically generate safety-critical test scenarios for Unmanned Traffic Management (UTM) systems, achieving an 8× improvement in vulnerability discovery efficiency over expert-guided testing.
AISLE discovered 6 new CVEs in curl, including the oldest vulnerability ever reported (over 25 years old), using its model-agnostic AI system. All findings were fixed in curl 8.21.0.
Flounder is an open-source AI agent-based tool that automates vulnerability discovery in codebases. Users describe the target and the tool autonomously downloads code, conducts deep code audits, tests vulnerabilities locally and online, and generates reports.
OpenAI announces Patch the Planet, an initiative with Trail of Bits to help open-source maintainers strengthen security by using AI models to identify and patch vulnerabilities, reducing the burden on maintainers.
Introduces an 8-stage vulnerability discovery agent based on Claude subscription, reproducing the core ideas of the Cloudflare Project Glasswing paper. It uses multiple narrow agents, intentional disagreement verification, and reachability gating to break down exploit analysis into precise steps, without the need for API keys.
AI-based security scanning has discovered 17 bugs in Perfetto's trace processor over 10 weeks, highlighting the potential for AI to uncover vulnerabilities in long-tail code that previously received little attention.
An autonomous AI agent from depthfirst discovered 21 zero-day vulnerabilities in FFmpeg, including a network-reachable RCE via a single 183-byte packet, for only $1,000 in compute costs; the find highlights the disparity between automated bug finding and patching.
Anthropic has released an open-source reference implementation for vulnerability discovery and remediation, building a verification chain with a seven-stage pipeline based on Claude, aimed at reducing false positives and ensuring closed-loop fix verification.
Anthropic's Claude Mythos Preview model, used by 50 partners, has uncovered over 10,000 high- and critical-severity software vulnerabilities, including 2,000 bugs in Cloudflare's systems and a critical flaw in wolfSSL, signaling a paradigm shift in software security.