AI Vulnerability Cataclysm: How to Prepare for the Coming Threat | Gadi Evron posted on the topic | LinkedIn
The AI Vulnerability Cataclysm is Coming: What It Is and How We Prepare
Authors: Heather Adkins, Gadi Evron
We are six months away, but hopefully longer, from the upcoming vulnerabilities cataclysm. We can prepare, mitigate harm, and maybe win if AI defense catches up.
Throughout our careers, we’ve avoided security alarmism, guided by a simple principle: the sun will always rise again. But today, we must speak a hard truth. Optimism alone can’t shield us from what comes next.
Within six months, AI could make exploitation so fast it breaks cyber defense:
• AI dominance: AI is already topping HackerOne’s leaderboard.
• Accessibility: In DARPA’s AIxCC, teams found 54 vulnerabilities in four hours, and their tools are now open-source.
• Signal from the top: Google’s Gemini-based “Big Sleep” has already uncovered dozens of vulnerabilities.
AI assistants like Cursor and Copilot fuel an explosion in global code. Vibe coding boosts velocity but removes critical checks, producing insecure code at scale.
Attackers are already in their AI singularity moment, whereas ours has not yet begun. APT28 is using LLMs for living-off-the-land operations. Per-install obfuscation, adaptive persistence, C2, steganography, EDR deception, and automated exploit generation are next. Imagine being an analyst as every compromise unfolds uniquely, at machine speed.
This is not a message of doom, and fuzzing or static analysis still surpass many agents. It is an urgent call to prepare. We may not be able to stop the storm, but we can reduce its impact.
Long-term, the solution involves defensive LLMs and self-defending architectures that can detect attacks, adapt in real-time, and mislead adversaries. Hints of this appear in AIxCC, where fixes were suggested alongside findings.
In the meantime, in an AI-driven threat landscape, the old familiar fundamentals will become existential:
• Shrink the attack surface: Retire legacy, remove unused code, disable unnecessary features. Accelerate zero-trust, and constrain what can run.
• Buy resilience, not features: Demand security proof points, hot-patching, and reliability as purchasing requirements.
• Turn the spotlight inward: Invest to find vulnerabilities before adversaries.
• Strengthen alliances: Expand bug bounties, establish safe reporting channels, and support open source.
But also, consider expanding to different avenues:
• Deception capabilities: Consider defenses not dependent on the attack tool used.
• Form coalitions: Vendors prioritize customers, and security can be treated as a priority. By forming coalitions, we can push the ecosystem to improve security.
• The AI literacy divide: Invest in educating yourself and your people to understand what’s possible. Check out Prompt||GTFO on YouTube.
Naturally, enterprise processes take time, but we should not wait to get started. The time for deliberation is over. It’s time for good people to come together and get focused.
References in first comment. | 49 comments on LinkedIn