AI Opens a Pandora's Box... A Flood of Bugs in Silicon Valley

As artificial intelligence (AI) is deployed to find software flaws, an unprecedented volume of bugs is being rapidly uncovered across the industry.

The New York Times reported on the 28th local time that security engineers in Silicon Valley are scrambling to patch and fix these vulnerabilities before hackers can exploit them.

OpenAI began using its technology to find flaws in open-source software starting last May, uncovering more than 1,300 defects so far.

Google also used AI in June to find and fix 1,727 bugs in its Chrome web browser.

This amount exceeds the number of bugs fixed over the past two years.

The number of "critical bugs" Google has fixed so far this year is also higher than the total discovered over the past eight years.

In addition, Microsoft released 1,461 patch updates this month alone, which is more than the 1,247 patches deployed over the entire previous year.

Foad Martin, who oversees cybersecurity at OpenAI, said, "AI has opened a Pandora's box in the realm of software vulnerabilities," adding, "AI companies have a responsibility to track and solve problems, and the ultimate goal is to inspect as much of the world's software as possible to patch vulnerabilities."

While experts across Silicon Valley are grappling with major shifts in security, some point out that this is likely just the beginning.

Matteo Collina, the chief technology officer (CTO) at Platformatic, a startup supporting the maintenance of the free development tool Node.js, predicted, "We are only just beginning to see a glimpse of it, and things will be 10 times worse moving forward."

According to the OpenJS Foundation, the nonprofit that operates Node.js, bug reports poured into Node.js this year, with 50 of those flaws verified and fixed.

This is the highest figure on record.

This month, OpenAI contacted Collina to warn him that bugs they discovered could allow hackers to break into internet systems and steal data.

Collina stated that he is working around the clock without a break to respond to these issues, and that he has AI agents work on his behalf during the middle of the night.

He said, "Now, nobody knows what this profession will look like in the future."

Volker Dusch, a security engineer working at the PHP Foundation, the organization that maintains the programming language PHP, said, "Just two years ago, finding a security vulnerability was a truly remarkable achievement. But now, that kind of social recognition has practically vanished. The entire way value is assessed is changing."

Matthew Prince, the chief executive officer (CEO) of internet infrastructure company Cloudflare, forecasted, "For the past two months, everyone has been living in extreme fear that someone might discover these bugs or that information could leak before patches and fixes are completed," adding, "For the next two years, we are going to live in a situation where critical vulnerabilities affecting the entire internet are discovered every week."

On the other hand, he also offered a positive outlook.

He added, "In fact, we are safer in a world where these issues are discovered," and "For two years, it will feel like the sky is falling, but once we get through that process, we will have a much safer internet."
 
(Photo: Getty Images)
※ Please note: This article was translated by AI and may contain errors.