The cybersecurity landscape is undergoing a dramatic shift with the rise of artificial intelligence, and a new assertion from startup Depthfirst indicates it may be changing quicker than many experts anticipated. Weeks after Anthropic’s much-touted Mythos AI model went viral for its ability to find dozens of major exploits in common web technologies, Depthfirst has unveiled that its AI system has uncovered more critical exploits that Mythos allegedly missed. Notably, the company says that it did all this at a fraction of the cost.<\/p>\n\n\n\n
The news reveals the competition among AI firms to create specific cybersecurity models that could be used to detect software vulnerabilities before they are exploited. In today’s day and age, where cyber threats are becoming more advanced, AI is no longer just a tool for safeguarding systems\u2014it’s a method for identifying vulnerabilities buried deep within the software that drives the modern internet.<\/p>\n\n\n\n
The AI developed by Depthfirst is specifically designed for vulnerability discovery, as opposed to general purpose-reasoning, according to CEO Qasim Mithani. This laser-focused approach, he says, enables Depthfirst to deliver the same or greater performance as larger AI systems, but with much lower computational requirements. With Depthfirst’s technology, tasks that take around $10,000 with Anthropic’s Mythos can be done for around $1,000, Mithani says.<\/p>\n\n\n\n
The startup’s announcement follows a significant boost in investor confidence. Earlier this year, Depthfirst reportedly raised $80 million in funding at a valuation of approximately $580 million. With this momentum, the company is looking to take the next step with the Open Defense Initiative, which will offer $5 million in credits for AI tools to organizations and open-source developers who want to be supported in finding vulnerabilities in their software projects.<\/p>\n\n\n\n
Some AI cybersecurity programs are limited-access, requiring customers to be special partners, but Depthfirst says it plans to make the technology more widely available. Applicants will still be considered, however, the company will give preference to software that is core to internet infrastructure and public services and to those that have been open-source projects.<\/p>\n\n\n\n
This decision is part of a recent trend in the cybersecurity community to worry about the \u201cdual use\u201d capabilities of sophisticated AI systems. These technologies can be used by defenders to identify or resolve vulnerabilities but also may be used by malicious people to locate and exploit vulnerabilities. Mithani suggests limiting access could prove ineffective over time, as cybercriminals are getting their hands on powerful AI capabilities, too.<\/p>\n\n\n\n
Today, cybersecurity is a new era, with both the defenders and the attackers harnessing the power of AI. The security community is keen to harness AI to enhance internet security, discovering weaknesses that human analysts may have overlooked. But recent events have shown that bad groups are already leveraging AI to boost offensive campaigns. Cyberattacks have been seen using AI for technology firms, with cases of AI-assisted attacks, automated exploit development, and sophisticated phishing campaigns, all of which add to the challenge of security defenses.<\/p>\n\n\n\n
Among the biggest finds allegedly uncovered by Depthfirst sits NGINX, a widely-used web server platform. A significant section of the web infrastructure is using NGINX and it is adopted by many organizations, ranging from small to enterprise-level. The vulnerability has been in the software since 2008 and could have left countless systems exposed for almost 20 years, according to Mithani.<\/p>\n\n\n\n
The finding, if true, would mark the incredible capabilities of AI-driven vulnerability research. Undetected security flaws can be a huge risk, as they can be used by hackers to gain access to systems for years without being noticed. Knowing such weaknesses before being exploited can greatly enhance internet security.<\/p>\n\n\n\n
The industry seems to be getting more optimistic about the abilities of AI for vulnerability discovery. Security experts say AI can delve through massive amounts of source code much faster than a human researcher. AI can analyze code sequences, pinpoint edge cases, and detect potential vulnerabilities that may be overlooked in complex software environments.<\/p>\n\n\n\n
Depthfirst also says it has discovered a critical Linux weakness in the open-source OS that is used in millions of servers, cloud applications, embedded devices and enterprise systems around the globe. The vulnerability may lead to the ability of attackers to run unauthorized code on vulnerable systems, the company said. The specifics about the vulnerability have not been made public yet, likely in an effort to keep users safe until a patch is created.<\/p>\n\n\n\n
The company says it’s found issues in Google Chrome, in addition to vulnerabilities in the server and operating systems. Google has now confirmed the results and fixed the problems with security updates. These vulnerabilities were classified as high severity because of their ability to enable attacks via malicious websites, and there is a need for proactive vulnerability detection.<\/p>\n\n\n\n
One other noteworthy claim is FFmpeg, a popular open-source multimedia processing framework that helps video, audio, and media capabilities on thousands of digital platforms. The AI identified 12 previously unknown vulnerabilities in the project, which Anthropic’s Mythos was unable to find, according to Depthfirst. FFmpeg is widely used by many content delivery, streaming and social media platforms and even minor vulnerabilities could have far-reaching impact if abused.<\/p>\n\n\n\n
While there’s been plenty of hype around AI vulnerability discovery, some experts have not been so enthusiastic. Software maintainers stress the importance of discovering bugs as just one aspect of cybersecurity. The challenge is often more difficult in the process of accurately figuring out vulnerabilities, creating effective fixes, testing patches and making sure update doesn’t create new problems.<\/p>\n\n\n\n
Some experts believe that although AI can greatly speed up the process of identifying vulnerabilities, human intervention is still necessary for remediation and ongoing software maintenance. Good cybersecurity involves not just finding vulnerabilities, but also finding good solutions that won’t compromise the software’s functions and stability.<\/p>\n\n\n\n
Despite this, the progress made by firms like Depthfirst and Anthropic shows AI is emerging as a valuable asset in the cybersecurity toolset. As software systems become more complex, AI in vulnerability research can help organizations detect vulnerabilities on a scale that would be difficult to achieve without the use of AI.<\/p>\n\n\n\n
This is not the only development in the cybersecurity field. As opposed to general-purpose AI, companies are building very specific AI systems for particular sectors like infrastructure protection, software development, security research, etc. The future of these technologies is promising and has the potential to revolutionize the way vulnerabilities are identified, evaluated, and addressed in the digital landscape worldwide.<\/p>\n\n\n\n
The cyber arms race is likely to get more intense as cyber threats continue to evolve and attackers increasingly leverage AI-powered techniques. While it’s not clear if AI will ultimately tip the scales in favor of defenders, there’s little doubt that artificial intelligence will be a key element of the future of cybersecurity.<\/p>\n","protected":false},"excerpt":{"rendered":"
The cybersecurity landscape is undergoing a dramatic shift with the rise of artificial intelligence, and a new assertion from startup Depthfirst indicates it may be changing quicker than many experts anticipated. Weeks after Anthropic’s much-touted Mythos AI model went viral for its ability to find dozens of major exploits in common web technologies, Depthfirst has […]<\/p>\n","protected":false},"author":5,"featured_media":3203,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"tmauthors":[34],"class_list":{"0":"post-3199","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-blog"},"acf":[],"yoast_head":"\n