Teaching AI to Find Real Vulnerabilities — David Brumley, Bugcrowd
David Brumley demonstrates how to train AI models to find security vulnerabilities in code through a stepwise method—from crashing a program to reading and writing memory to full attacks.
The major challenge is measurement: since many possible vulnerabilities exist, a model can always claim to have found one, so standard tests fail. Brumley built actual training pipelines with sandboxes and objective evaluators that verify whether exploits actually work. He demonstrated this on V8 (Chrome's JavaScript engine) against 41 real vulnerabilities where the best models achieved around 95 percent success, including one previously unknown vulnerability.
Vibekollen prepared this summary with AI from the original publication. The content belongs to AI Engineer.
More from AI Engineer
Inside Arca's Long-Horizon Agents That Run the Business - Aman Singh, Arca
AI Engineer 23 Oct
Real AI Agent Attacks and What Would Have Stopped Them — Andrey Rybka, Bloomberg
AI Engineer 23 Oct
Outside of tech there has been no financial payoff to US companies for using AI, now viewed as a margin-hurting cost center, as VC-backed firms burn more tokens
Techmeme 4 h ago
Source: Replit recently moved most AI spend from Anthropic to OpenAI, which gave 30%+ off in a deal worth $100M+/year, after Anthropic discontinued its discount
Techmeme 6 h ago