The AI-Discovered Bug That Could Have Become a Cybersecurity Disaster

In early August, Sagi Tzadik asked an AI agent to take a security flaw it had found in WordPress and see whether the same weakness could be made to work against Drupal, another popular content management system. Eight hours later, the agent reported that it had failed. Then it added that, in the course of trying, it found a flaw in PHP, the programming language on which both systems—and as much as 70% of the web—depend.Tzadik, a security researcher at cybersecurity firm Wiz, assumed that the AI had made a mistake. “Models tend to hallucinate,” he tells TIME. But the exploit, which took advantage of a weakness that had gone undetected for more than a decade, worked.Unbeknownst to Wiz’s team, researchers at another cybersecurity firm, Calif—working with OpenAI—had used AI to find a related flaw. It suggests that once AI reaches a certain capability level, it is a matter of time before some longstanding weaknesses are unearthed. AI companies have been trying to ensure that defenders including Wiz and Calif get there first by giving them early access to new AI models before the equivalent capabilities trickle down to malicious users. This time, it worked. The episode offers a glimpse i...