AI as a tool for vulnerability discovery
Artificial intelligence has become an essential tool in uncovering hardware and software flaws, performing tasks that would traditionally require years of human effort. AI models such as Mythos, which were trained on a vast amount of publicly available data, can quickly identify vulnerabilities that might otherwise go undetected for a long time. In one notable case, Mythos managed to compromise nearly 20 percent of systems it tested in just ten minutes by running thousands of automated scripts.
Scott Best, a senior director at Rambus, conducted an experiment to evaluate how effective Mythos was at finding security flaws. He created a simulated network using virtual machines, each running a different commercial operating system. The AI was then deployed to run penetration scripts and assess each system. This setup allowed Mythos to uncover vulnerabilities that typical security teams might overlook, especially those that are obscure or difficult to detect.
During the test, Best observed the AI probe every system in the network. The results were striking: approximately one in five systems had exploitable weaknesses. The entire process, from setup to detection, happened so quickly that it occurred within a 10-minute window, all while Best was sitting in a pub. This highlights how efficiently AI can operate in uncovering vulnerabilities, even in complex and varied environments.
Black box challenges with AI
One of the most significant challenges with AI is its nature as a black box. Engineers and security professionals are often unable to track how AI systems obtain data or how they combine this data with other sources. This lack of transparency makes it difficult to predict or control how AI might behave, especially when it comes to identifying and exploiting vulnerabilities. As a result, it's challenging to stop AI from uncovering potential security risks.
Marc Witteman, a senior director at Keysight Technologies, has emphasized the difficulty of containing AI technologies. He noted that even if a specific company stops using a harmful AI model, others will continue to develop and use similar systems. AI's ability to find new security holes at an unprecedented speed outpaces traditional tools, making it a powerful but potentially dangerous force.
Because of this, security tools must now adapt to monitor AI behavior. Traditional methods such as scanning for viruses or analyzing traffic patterns are no longer sufficient. AI operates outside conventional systems, meaning that security visibility must expand to cover new areas where vulnerabilities could emerge.
Security must evolve with chip design
The concept of chip security is changing in an AI-driven world. No longer is it a separate discipline that can be addressed at the end of the design process. Instead, security is becoming an integral part of every stage, from the initial design of a chip to its manufacturing and ongoing use. Engineers must now validate each step and process for potential security risks, ensuring that nothing is overlooked.
In the past, validation focused primarily on performance and power specifications. A chip was considered successful if it met these metrics and functioned correctly at time zero, regardless of any underlying flaws. However, this approach is no longer adequate. Engineers now need to build resilience into every aspect of their designs, addressing potential problems at their root before they become actual vulnerabilities.
The chip industry has long been aware of vulnerabilities, but without the right tools, exploiting them was not a practical concern. AI changes that dynamic. It enables the simultaneous execution of hundreds of attacks, probing every system for weaknesses. This means that what was once a slow and difficult process of manual exploitation is now something that AI can handle at an alarming speed, fundamentally altering how security must be approached in the future.