> The vulnerabilities exist whether or not the AI does.

No. Even if we ignore the people newly enabled to slop out vulnerable software without having a clue about security, the AI powered supply chain hacks inserting vulnerabilities, the influx of AI contributions that drown out improvements in FOSS security, and the industry pressure to ship faster while reducing quality or be left behind -- all because of AI -- security through obscurity has historically been the most effective security.

I don't think your argument holds under theory or (especially) practice.

▲

lioeters an hour ago | parent | next [-]

> security through obscurity has historically been the most effective

Security through mathematical impossibility is the most effective. AI-assisted brute-force vulnerability search is revealing that what we considered obscure a year ago is no longer hidden and was never secure.

▲

tptacek an hour ago | parent [-]

I think the even more important observation here is that the cat is already out of the bag on this approach to vulnerability research; it can be done effectively with open-weight models today.

▲

lioeters an hour ago | parent [-]

I see it's an arms race between white and black hats using this new tool to expose vast new areas of vulnerabilities and fixing them to improve security as fast as possible. It's always been a cat-and-mouse chase, or maybe more like a whack-a-mole, but now accelerated with super-human ability on both sides.

Fast-forward a few years of this, I wonder whether they will have found all the low-hanging fruits (from AI perspective) and the situation will settle down; or it will keep getting worse - with AI development never reaching a plateau - until we admit that all existing software and hardware are hopelessly vulnerable and likely compromised already.

	▲	tptacek an hour ago \| parent [-]
		The capabilities open-weights models had months ago already made this a foregone conclusion.

▲

tptacek an hour ago | parent | prev [-]

The vulnerabilities we are seeing in the news are, as a rule, not things introduced by AI. That could change, but this rebuttal isn't on point currently.