Cybersecurity and AI: A Story That Makes You Think

A fork of CBMC made it possible to discover 8 (yes, eight) critical vulnerabilities in the code of one popular network stack. Not just “a neural net found something,” but real, mathematically proven schemes with computed input parameters.

In response to a request to fix them, Claude Opus and OpenAI Sol unequivocally said that this is cybersecurity work, and why don’t you Russian hackers go take a stroll over to GLM.

Which breeds questions.

1. So it turns out we have in our hands a security-analysis scheme that is not noticed by the built-in classifier for such cases at OpenAI and Claude. How many more such schemes are there, and how many of them are already being used—on the one hand, by knife-and-axe hackers, and on the other, by hackers in government service?

2. If you want cybersecurity, you have to be American, and there’s no other way. So everyone else, it turns out, is not allowed cybersecurity by definition.

3. If cybersecurity is allotted only to Americans, what sense does it make for other people, discriminated against by citizenship, to bother with CVEs that don’t concern their country? Cybersecurity is a matter of trust and goodwill, and here they demonstrate from the very start an unfair attitude toward researchers. From the outset they operate on the principle of bad faith.

4. It’s time to have our own. Our own what? Well, our own everything, starting with PHP (https://www.cybersecuritydive.com/news/php-website-vulnerabilities/833580/), and ending with OSes of every stripe and application, and neural nets too. Because if a white-hat hacker is discriminated against, he swiftly changes his colors, since he has to live on something. And becoming that kind of hacker is easier than ever. Hence vulnerabilities that will not be fixed outside the national system. Of course, in an ideal world all people should agree and work for the good of humanity without any discrimination, but even Yegor Fyodorovich understood well that we are no longer following that plan.

5. To close holes faster than they appear, a different development methodology is needed. Such as, for example, this very proof-based programming using CBMC and neural nets. A developer without it is bound to lose outright to the hacker (we send a fiery example from Sony https://www.polygon.com/ps5-jailbreak-hack-homebrew-gta-6-firmware-update/).