Anthropic's generative AI system Mythos has reportedly identified a large number of potential vulnerabilities, including a 20-year-old bug in Firefox. Discussion is focusing on how the speed of AI-driven discovery could affect incident response in the field.
Mythos Preview, a vulnerability-discovery AI developed by US AI company Anthropic, is reported to have detected 23,019 potential vulnerabilities in open-source software. The targets included widely used software such as nginx, jq, MapServer and wolfSSL. It also reportedly discovered a 20-year-old memory-related vulnerability in Mozilla Firefox that had gone unnoticed for many years. The reports explain that AI is now reaching areas of vulnerability that human specialists and automated testing alone were unable to identify.
At the same time, an evaluation by the UK's AI Security Institute indicated that, in a controlled environment, Mythos could autonomously carry out attacks across multiple stages and potentially discover and exploit vulnerabilities. The evaluation did not, however, establish that it could successfully attack real-world environments, and it emphasized the importance of validation and patch deployment by defenders.
The article reports that while AI is creating the ability to identify large numbers of vulnerabilities, companies will need systems capable of accelerating remediation and prioritizing fixes, validating the scope of impact, and deploying them in production. It also presents the view that cases such as Mozilla's show how defenders may be able to limit damage by acting first.
For Japanese companies, the issue is not to wait for AI to find vulnerabilities, but to determine how to build response systems for after they are found. In addition to applying patches to operating systems and browsers, companies with proprietary systems will need to establish processes covering remediation assessment, impact evaluation, testing and production deployment.