Taken together, several developments of recent months paint a rather striking picture. Oracle, for example, fixed more than 1,400 vulnerabilities in a single security update, and AI technologies are reported to have played a role in discovering a large share of them. At the same time, research by Theori into 28 applications built with AI found 434 exploitable vulnerabilities. In other words, while AI uncovers security gaps in software, it also causes new ones to emerge in the course of programming.
How, then, is this process affecting the work of cybersecurity professionals?
GitHub has reduced the reward for critical vulnerabilities in its public Bug Bounty programme to $10,000. Intel has stopped paying cash rewards to those who discover security flaws. These decisions are linked to the way AI is accelerating security research. The number of vulnerabilities found with AI is now growing so fast that companies are either cutting payouts to a minimum or refusing to pay at all.
Another notable point is that white-hat hackers used to have a financial interest in finding such flaws. That model, in itself, encouraged a public contribution to strengthening overall security, because the vulnerabilities found were then fixed. Today, shrinking or cancelled payouts not only reduce interest in finding security flaws, but also allow those flaws to persist unpatched for long periods — ultimately putting overall security at risk.
Yet AI's impact on the field is not limited to finding vulnerabilities. The AgentForger vulnerability discovered in OpenAI's ChatGPT agents allowed an attacker to create a covert, remotely controlled AI agent operating inside an organization. OpenAI has, admittedly, recently announced that the flaw has been fixed. Another notable — and more serious — case concerns OpenAI's Astra model. After the model demonstrated high-level autonomous cybersecurity capabilities, the company suspended certain internal activities that did not meet its strengthened security requirements.
What does all this mean for cybersecurity?
AI accelerates the discovery of vulnerabilities while also expanding attackers' technical capabilities. As a result, the window between a vulnerability being discovered and being exploited is narrowing, and the ability of security teams to respond becomes even more critical. Moreover, according to a CrowdStrike report, roughly 79% of attacks are carried out without the use of malware. This reality requires modern SOCs to correlate data from multiple sources, analyse network and user behaviour, and detect suspicious activity earlier.
In my view, AI does not eliminate the need for cybersecurity professionals. On the contrary, it changes the nature of their work.
The key advantage will no longer lie in finding more vulnerabilities, but in correctly assessing their real risk, detecting threats in time and making decisions faster.
Sources & links
