Teaching AI to Find Real Vulnerabilities — David Brumley, Bugcrowd
David Brumley demonstrates how to train AI models to find security vulnerabilities in code through a stepwise method—from crashing a program to reading and writing memory to full attacks.
The major challenge is measurement: since many possible vulnerabilities exist, a model can always claim to have found one, so standard tests fail. Brumley built actual training pipelines with sandboxes and objective evaluators that verify whether exploits actually work. He demonstrated this on V8 (Chrome's JavaScript engine) against 41 real vulnerabilities where the best models achieved around 95 percent success, including one previously unknown vulnerability.
Vibekollen prepared this summary with AI from the original publication. The content belongs to AI Engineer.
