Vulnerabilities are running out of places to hide, thanks to frontier AI models, and it could create problems for those that sell software.
The "vulnpocalypse," or the onslaught of vulnerabilities surfaced through the proliferation of AI, is having far-reaching consequences on the economics and demands previously associated with bug hunting. Software publishers are used to operating in a world where code reviews, researcher attention, and discovery capacity are finite. But over the past two years, things have changed. Large language models (LLMs) have automated and sped up large portions of the bug discovery pipeline, and frontier models could accelerate that process even further.
Bug bounty platforms report dramatic increases in the number of reports they triage. HackerOne saw reports double year over year, while Bugcrowd and TrendAI's Zero Day Initiative (ZDI) similarly cited massive spikes. This has led platforms to deploy AI-powered triage to automate parts of the bug bounty process, and some experts believe the new LLM reality will reconfigure the independent security research economy to become more of a volume game than a severity one.
Aaron Portnoy, chief product officer at Mindgard and a founder of the Pwn2Own hacking competition, tells Dark Reading that because of AI, "vulnerabilities are losing a place to hide."
"Software vendors used to be able to get away with shipping buggy software with no real accountability for a very long time, but now they can't really hide anymore, because AI doesn't sleep and can [find vulnerabilities] at scale," he says.