Felix hat sich den Artikel durchgelesen, und für die anderen Felixe zur Zeitersparnis mal den Kernpunkt rauskopiert:
>both agencies and manufacturers knew that law enforcement could purchase targeted hacking tools like GrayKey (for phone unlocking), or even remote exploitation tools like NSO Group’s Pegasus, assuming they needed them badly enough. Vendors like Apple and Google played a vigorous defense, closing vulnerabilities as soon as they learned about them. But offensive vulnerability hunters consistently managed to keep the edge.
>The era of AI bug hunting is here
>This April (just four months ago!) Anthropic announced a new model called Mythos that happened to be unusually skilled at software vulnerability finding. [...] The list of serious vulnerabilities that these models have found is getting scarier (or more impressive) by the day.
>At first glance, this might seems like good news for the offensive team, and for hackers in general. But I doubt that’s how this will play out in the long term. Defenders are now in the process of patching every bug they can find — often decades worth of bugs — and the backlog feels huge. But they’re making progress. Entire CI toolchains are being rebuilt to incorporate AI-based vulnerability scanning before software ever reaches the point where a human will touch it. While I doubt this means that every bug will be found (even calculating the number of bugs in a piece of code is probably uncomputable), in the real world, it does feel likely that we’re going to hit some sort of a ceiling on the number of useful bugs, and probably we’ll hit it soon.
>Thus: over the next two years, major pieces of software are likely to run out of remotely-exploitable bugs.
>Obviously I think this is great. But for law enforcement and offensive intelligence agencies, it’s going to be a nightmare. For the first time since 2010, law enforcement might experience what it looks like to really “go dark”, across a huge category of advanced (well-maintained) devices and pieces of software.
Was der Artikel nicht erwähnt ist, dass die Hersteller natürlich den Quelltext haben, was die KI-Analyse-Fähigkeiten dann nochmal stark steigert - und zwar im Gegensatz zu den Hägger-Tools-Herstellern, die den Quelltext nicht haben. Letzte dürfen dann erst mal KI-gestützt die ganze Disassembly zu C-Kot etc. dekompilieren, damit die KI nun anständig analysieren kann.