AI Vulnerability Hunting

AI Vulnerability Hunting

I came across these articles today and thought they paint an interesting picture when you consider them all together.

Context and Interesting Articles

• Mythos Finds 271 Vulnerabilities for Mozilla
• Mythos Finds a curl Vulnerability
• You Need AI that Reduces Maintenance Costs

Reading these articles made me think of Mike Rowe’s “Safety Third” video. There are a lot of corollaries to security.

A Tale of Two Shitties

On one hand, Mythos found 271 vulnerabilities in Mozilla’s products, and only one in curl. How can that be? Mozilla has leaned pretty heavily into AI development and development of AI features and capabilities in their products. They have an OK track record with security, but they are primarily focussed on shipping their product. The curl team on the other hand, has banned AI contributions and taken a very security first approach to development. Curl has exhaustive security analysis as part of their development lifecycle. Daniel has always been forward with the curl project’s security aware processes and has stood by them, even at the risk of being made “obsolete by AI.” Curl doesn’t have to worry about the graphical display of data and providing an executable runtime to the internet (JavaScript).

Put together, all of this is unsurprising. Browsers today are more virtual machine than they are applications. It’s not surprising that an ecosystem with as many capabilities as a browser or email client would have more security risk. Proponents of Mythos will look at the Mozilla case study and simply stop there. The curl case study is more interesting. What curl’s experience says is if you implement comprehensive security testing, work at a pace humans can understand, and keep your project scoped narrowly, Mythos doesn’t really matter.

This is the cold, hard truth of Information Security I’ve been speaking about since 2007. The boring stuff is the most effective. Understand your code base, your environment, the threat models in play, inventory, produce audit records, review those audit records, do security scans of you code and infrastructure, fix the things those scans find, and most of all, Keep It Stupid Simple. These things will not get your glory. These things will make your company and product reasonably safe.

A Parallel to the AV Industry

In the late 90s and early 00s, anti-virus companies were creating and releasing computer viruses to drive up demand for their products. Security practioners were stuck in a bit of a Catch-22. We needed Anti-Virus to secure our networks, but we were reaosnably sure that the AV companies were making things worse. As compliance requirements required the use of anti-virus on all computers, those of us managing Linux servers were particularly upset because most of the AV products created substantially more risk than they mitigated.

Today, using AI assisted coding, developers are able to produce more code faster. AI code is more verbose and less secure. More code, more vulnerabilities. More repetition and reinvention in a codebase, the more likely a vulnerability is to occur and the harder it will be patch.

AI writes more lines of code than a human for the same task. This could be due to incentives in the system. These companies charge by the token for output, so the more they generate, the more they can bill. This effect is subtle, but it’s worth noting this could be knob that the AI companies are dialing up to generate more revenue. The number of skills/tools/wrappers I’ve seen to reduce input and output tokens for AI model is staggering. More code is more complexity, more complexity means higher chance for vulnerabilities.

Enter Mythos. Now, you can use Claude Code to write your complex code, and then use Mythos to find all the vulnerabilities in the code Claude created. It’s an ouroboros of AI slop and inefficiency! I’m leary of products that seem to require add-ons to be fully operational. I wouldn’t call Claude Code fully functional if it requires a large number of skills/tools and arcane incantations to reduce the complexity of code it generates and I still need to pay for Mythos to scan that code to find potential vulnerabilities. This is a classic up-sell, enshittification model.

Robot Dogs on the Attack

Unrelated, but cool video on robot dogs!

No Artificial Colors, Flavors, or Intelligence were used in the creation of this content.