AI可以浮出水面比永远更脆弱人类仍得决定接下来会发生什么

思想领袖

AI可以浮出水面比永远更脆弱人类仍得决定接下来会发生什么

在 Google 上的首选来源中添加 Unite.AI

多年来，网络安全小组一直以一个简单的假设运作：如果我们能更快地发现更多的弱点，我们就能使软件更加安全。

人工智能正在测试这种假设。 网络安全正暴露出一个不会随着AI减速而消失的挑战。 各组织已经面临越来越多的人工智能生成的脆弱性调查结果，这些调查结果仍然需要人的验证、优先考虑和补救。

格拉斯温项目最近的调查结果是迄今最清楚的例子之一。 据报道，Claude Mythos Preview在短短几个月内就发现了26 000多个软件项目的脆弱性发现。 然而，根据对Glasswing公开披露分类账的独立分析，只有大约10%的这些调查结果达到了披露过程，最终只有不到1%得到补丁。

这些数字令人吃惊，该行业花了几十年时间优化发现。 以AI规模处理脆弱性发现的能力。

网络安全中的瓶颈不再被发现。 接下来会发生什么。

寻找脆弱性从未是最难的部分

Anthropic在 " 玻璃翼项目 " 的早期更新中指出，进展日益受到限制的不是发现弱点，而是核查报告、协调披露和支持补救工作所需的人力工作。 该公司还指出，一些维护者要求降低披露率，因为他们缺乏处理生成的大量调查结果的能力。

这一区别很重要，因为发现脆弱性和脆弱性补救是根本不同的活动。

发现日益成为一个模式识别问题。 现代AI系统在分析大型代码库，识别异常行为，追踪执行路径，以及表面潜在弱点方面都非常出色。

补法不同。 解决脆弱性需要根据具体情况。 必须有人确定问题是否合法，了解潜在影响，评估可能的解决办法，确保变革不引入回归，协调披露时限，与利益攸关方沟通，并最终接受对结果的责任。

最后一个部分至关重要。 大赦国际可以查明可能的脆弱性，但不能对接下来发生的情况负责。 核实、分类、确定和报告总是需要一个人对他们所维护的项目负责。 这需要一些时间，从那些经常有全职工作，家庭，其他义务的人那里来竞争他们的注意力。 在很多开源项目中，限制因素不是风险的可见度；而是维护者和安全小组负责评价和回应越来越多的调查结果的能力。

这是发现和补救之间的根本区别。 发现日益成为AI可以帮助我们扩大范围的问题。 补救仍然取决于有背景、权威和问责制的人对AI 发现采取行动。

开源挑战

这种动态在开源生态系统中变得更加明显。 开源组件在98%的商业密码库中存在，因此世界上绝大多数的数字基础设施都依靠相对较少的捐助者集团维持的项目。

在许多情况下，负责维护这一关键软件的人是志愿者或个人，他们兼顾项目责任与全职工作和个人义务。 随着AI增加软件量和发现的弱点，这些维护者跟上速度的能力成为安全方程式中日益重要的一部分。

当人工智能系统突然产生针对项目生态系统的数百或数千个潜在发现时，这些维护者就成了限制因素。

这不是对维护者的批评。 这是现实的反映。

甚至在AI带动的脆弱性发现出现之前，许多开源项目就因资源有限，安全期望不断提高，维护负担日益加重而挣扎。 AI正在加速对一个已经伸展的系统的压力。

挑战不仅仅是确定是否存在脆弱性。 挑战在于之后发生的一切。

得有人来检讨报告总得有人来转载一下这个问题必须有人来决定这是否构成安全风险。 得有人去开发并测试一个固定。 总得有人来协调公布和发布最新消息这些责任不能简单地自动化。

随着AI生成的研究结果继续增加，依赖开源软件的组织将日益依赖于维护该软件的人员的健康和可持续性。

准备AI 脆弱性发现风暴

企业应该做什么？首先，各组织需要认识到AI驱动的发现不是一个未来问题。 它已经发生。 Glasswing项目表明，前沿模型能够以几年前难以想象的规模发现脆弱性。

第二，安全领导者应评估其补救过程能否与发现能力同时扩大。 许多组织在寻找弱点方面投入大量资金，同时对负责解决这些弱点的人员和进程投入不足。

三，企业应更密切地注意软件维护作为一种安全功能。 安全经常在预防和侦查方面得到讨论，但长期维护仍然是风险管理中最重要和未得到充分重视的组成部分之一。 AI可能使弱点更容易发现，但它并没有减少随着时间的推移保持关键软件安全的责任。 各组织需要制定生命周期所有权战略，使其能够有意地实现现代化，而不是在出现风险时被迫匆忙迁移或采取反应性补救措施。

最后，各组织应支持它们所依赖的更广泛的生态系统。 随着AI在开源软件上加速发现脆弱性，维护者将面临越来越多的需求。 软件供应链的安全最终取决于这些维护者是否拥有应对所需资源。

AI可以更快地发现弱点。 但找到它们并不能保证软件的安全比较困难的工作是验证风险、优先处理重要事项、提供经测试的补救以及长期维护安全软件。 随着脆弱性发现的加快，各组织将需要以专门知识、问责制和明确的服务水平为基础的持续补救能力。

因为网络安全最困难的问题不是寻找弱点。 接下来会发生什么。

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Thought Leaders

AI Can Surface More Vulnerabilities Than Ever. Humans Still Have to Decide What Comes Next.

Add Unite.AI to your preferred sources on Google

For years, cybersecurity teams have operated under a simple assumption: if we could find more vulnerabilities faster, we would make software more secure.

Artificial intelligence is testing that assumption. As the broader AI conversation shifts from rapid adoption to measurable value, cybersecurity is exposing a challenge that won’t disappear with an AI slowdown. Organizations are already facing a growing volume of AI-generated vulnerability findings that still require human validation, prioritization, and remediation.

Recent findings from Project Glasswing offer one of the clearest examples yet. Claude Mythos Preview reportedly identified more than 26,000 vulnerability findings across software projects in just a few months. Yet according to an independent analysis of Glasswing’s public disclosure ledger, only about 10% of those findings have reached the disclosure process, and fewer than 1% have ultimately been patched.

Those numbers are striking, but they shouldn’t be surprising. The industry has spent decades optimizing for discovery. What it hasn’t built is the capacity to process vulnerability findings at AI scale.

The bottleneck in cybersecurity is no longer discovery. It’s what happens next.

Finding Vulnerabilities Was Never the Hardest Part

In an early update from Project Glasswing, Anthropic noted that progress was increasingly constrained not by finding vulnerabilities, but by the human work required to verify reports, coordinate disclosures, and support remediation efforts. The company also noted that some maintainers requested slower disclosure rates because they lacked the capacity to process the volume of findings being generated.

This distinction matters because vulnerability discovery and vulnerability remediation are fundamentally different activities.

Discovery is increasingly a pattern-recognition problem. Modern AI systems excel at analyzing large codebases, identifying unusual behavior, tracing execution paths, and surfacing potential weaknesses.

Remediation is different. Fixing a vulnerability requires context. Someone must determine whether the issue is legitimate, understand the potential impact, evaluate possible fixes, ensure changes do not introduce regressions, coordinate disclosure timelines, communicate with stakeholders, and ultimately accept responsibility for the outcome.

That last part is critical. AI can identify a possible vulnerability, but it cannot be accountable for what happens next. Validating, triaging, fixing, and reporting will always require a human who is accountable to the project they maintain. And that takes time from people who often have a full-time job, a family, other obligations competing for their attention. In many open source projects, the limiting factor isn’t visibility into risk; it’s the capacity of maintainers and security teams to responsibly evaluate and respond to an ever-growing volume of findings.

This is the fundamental difference between discovery and remediation. Discovery is increasingly a problem that AI can help us scale. Remediation still depends on people who have the context, authority, and accountability to act on what AI finds.

The Open-Source Challenge

This dynamic becomes even more apparent across the open source ecosystem. With open-source components present in 98% of commercial codebases, the vast majority of the world’s digital infrastructure relies on projects maintained by relatively small groups of contributors.

In many cases, the people responsible for maintaining this critical software are volunteers or individuals balancing project responsibilities alongside full-time jobs and personal obligations. As AI increases the volume of software and vulnerabilities discovered within it, the capacity of those maintainers to keep pace becomes an increasingly important part of the security equation.

When an AI system suddenly generates hundreds or thousands of potential findings against a project ecosystem, those maintainers become the limiting factor.

This isn’t a criticism of maintainers. It’s a reflection of reality.

Even before the emergence of AI-powered vulnerability discovery, many open-source projects struggled with limited resources, growing security expectations, and increasing maintenance burdens. AI is accelerating pressure on a system that was already stretched thin.

The challenge is not simply determining whether a vulnerability exists. The challenge is everything that happens afterward.

Someone has to review the report. Someone has to reproduce the issue. Someone has to decide whether it represents a security risk. Someone has to develop and test a fix. Someone has to coordinate disclosure and release updates. Those responsibilities cannot simply be automated away.

As AI-generated findings continue to increase, organizations that rely on open-source software will increasingly depend on the health and sustainability of the people maintaining it.

Preparing for the AI Vulnerability Discovery Surge

So what should enterprises do? First, organizations need to recognize that AI-driven discovery is not a future problem. It is already happening. Project Glasswing demonstrated that frontier models can uncover vulnerabilities at a scale that would have been difficult to imagine only a few years ago.

Second, security leaders should evaluate whether their remediation processes can scale alongside discovery capabilities. Many organizations have invested heavily in finding vulnerabilities while underinvesting in the people and processes responsible for resolving them.

Third, enterprises should pay closer attention to software maintenance as a security function. Security is often discussed in terms of prevention and detection, but long-term maintenance remains one of the most important and underappreciated components of risk management. AI may be making vulnerabilities easier to find, but it does not reduce the responsibility of keeping critical software secure over time. Organizations need a strategy for lifecycle ownership that allows them to modernize deliberately, rather than being forced into rushed migrations or reactive remediation efforts when risks emerge.

Finally, organizations should support the broader ecosystems they depend on. As AI accelerates vulnerability discovery across open-source software, maintainers will face increasing demands. The security of the software supply chain ultimately depends on whether those maintainers have the resources needed to respond.

AI can find vulnerabilities faster. But finding them does not make software secure. The harder work is validating risk, prioritizing what matters, delivering tested fixes, and maintaining secure software over time. As vulnerability discovery accelerates, organizations will need a continuous remediation capability backed by expertise, accountability, and clear service levels.

Because the hardest problem in cybersecurity isn’t finding the vulnerability. It’s what happens next.

Auto-fetched and translated by AI Atlas. All rights belong to the original author.