The AI Arms Race in Vulnerability Management, Who’s Winning?

The AI Arms Race in Vulnerability Management, Who’s Winning?

Speakers: Yotam Perkal, Security Research Lead, Pluto Security

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=FsR3aKEXsxM

Overview

In his compelling VulnCon talk, "The AI Arms Race in Vulnerability Management, Who’s Winning?", Yotam Perkal, Security Research Lead at Pluto Security, delves into the escalating competition between offensive and defensive security leveraging artificial intelligence. Perkal emphasizes that the rapid advancements in AI are fundamentally reshaping the landscape of vulnerability management, affecting every stage from discovery to remediation. The core premise of his presentation is that while AI offers unprecedented capabilities for both sides, attackers are currently better positioned to exploit these new tools due to fewer constraints and a more agile operational model.

Perkal's talk serves as an urgent call to action for the cybersecurity community. He highlights that the traditional assumptions and incremental defensive strategies are no longer sufficient in an era where the time to exploit newly disclosed vulnerabilities has collapsed from months to mere hours. The discussion moves beyond simply acknowledging AI's presence, instead focusing on the profound shifts required in defensive thinking, advocating for a paradigm change that embraces AI's strengths while understanding its limitations, particularly in the context of an increasingly automated and AI-driven threat landscape.

This article explores Perkal's insights into the evolving AI arms race, detailing the rapid advancements in offensive AI capabilities, the inherent challenges of securing AI-generated code, and the critical need for defenders to adopt innovative, AI-centric strategies. From context engineering to AI supply chain security and even AI-specific deception tactics, Perkal outlines a roadmap for how security teams can not only keep pace but potentially gain an edge in this fast-moving domain.

Background

▶ Watch: Time to exploit declining drastically (4:00)

The problem at the heart of Yotam Perkal's talk is the accelerating decline in the "time to exploit" – the window between a vulnerability's disclosure and its active exploitation in the wild. This trend, vividly illustrated by projects like Serge's app zero day clock, paints a grim picture for defenders. Perkal cites alarming statistics: the median time to exploit plummeted from 771 days in 2016-2018 to a mere 6 days in 2023, with projections suggesting it could shrink to just 4 hours by 2026. This compressed timeline leaves organizations with minimal opportunity to patch or mitigate newly identified threats, fundamentally altering the calculus of vulnerability management.

This rapid acceleration is not solely an AI phenomenon but is significantly exacerbated by it. Perkal points to Log4Shell in 2021 as a pre-AI harbinger, where the widespread nature and trivial exploitation led to immediate attacks, demonstrating how quickly a critical vulnerability could be weaponized. However, the advent of sophisticated AI models has supercharged this process. Attackers are now leveraging AI to scale operations, lower the barrier of entry for complex attacks, and reduce the skill level required to execute them.

Perkal traces a clear timeline of AI's impact on vulnerability research and exploitation:

• April 2024: Research demonstrated that LLM agents could automatically exploit one-day vulnerabilities, with GPT-4 achieving an 87% success rate at a cost of less than $9 per vulnerability, far outperforming other models. This marked a significant leap in automated exploitation of known flaws.
• November 2024: Google's Project Zero unveiled Big Sleep, an initiative integrating AI with existing fuzzing techniques. This project successfully identified and exploited a previously unknown vulnerability in SQLite before its human counterparts, signaling AI's capability in discovering zero-day vulnerabilities.
• Early 2025 (approximate): Anthropic announced its Cloud Security efforts had uncovered over 500 high-severity vulnerabilities in various open-source projects, some existing for decades.
• Weeks before the talk (early 2025): The Mitis leak revealed an astonishing 100x jump in AI's ability to write working exploits, with success rates reaching 70% compared to less than 1% in previous models. This included the discovery of a 27-year-old bug in OpenBSD and a 17-year-old vulnerability in FreeBSD, alongside many others awaiting coordinated disclosure. Even Small Language Models (SLMs) are now replicating similar results, further democratizing these capabilities.

This sequence of events underscores why the problem exists: AI's increasing proficiency not only in finding vulnerabilities but also in crafting functional exploits has created an unprecedented challenge. The traditional, human-centric pace of vulnerability management is simply no match for AI-driven automation, forcing a re-evaluation of fundamental security assumptions.

Key Findings

▶ Watch: Mitis leak: AI writing working exploits (100x jump) (8:00)

Yotam Perkal's presentation crystallized several critical findings regarding the "AI arms race" in vulnerability management. The overarching insight is that AI is a double-edged sword, offering immense potential for both offensive and defensive applications, but with a current tilt towards the attacker.

1. Attackers' Current Advantage: Perkal posits that attackers are presently better positioned to leverage AI. They operate with fewer constraints, focusing solely on finding and exploiting weaknesses, unburdened by the complex organizational requirements, compliance mandates, and extensive remediation processes that defenders face. This asymmetry allows them to more rapidly and efficiently weaponize AI capabilities.
2. Accelerated Attack Chains, Human Bottlenecks: While AI dramatically accelerates vulnerability discovery and exploit development, the human element remains a critical bottleneck for defenders. Tasks like coordination, communication, and thorough validation of AI-generated code or vulnerability reports still heavily rely on human expertise, creating a widening gap between the speed of attack and the pace of defense. This is exemplified by the struggles of maintainers like Daniel Steinberg of curl, who initially considered banning AI-submitted reports due to "slop" but now acknowledges their mixed quality.
3. Erosion of Core Assumptions: The rapid advancement of AI invalidates many long-held assumptions in cybersecurity. Defenders can no longer assume a significant time buffer between vulnerability disclosure and exploitation, nor can they assume that attackers require extensive human expertise to discover and weaponize flaws. The notion that an attacker needs to know about a specific CVE to exploit it is also challenged, as AI can autonomously discover and exploit unknown vulnerabilities.
4. The "Slop" and the Signal: AI-driven vulnerability reporting is characterized by a significant increase in volume, comprising both low-quality "slop" and genuinely valuable, high-severity findings. This surge overwhelms existing manual triage systems, putting immense stress on maintainers, CNAs, and security teams who must sift through the noise to identify critical signals.
5. AI's Inherent Security Blind Spots: Modern Large Language Models (LLMs) are primarily optimized for functionality, not security. They are trained and evaluated on whether code "works," not whether it's secure. This inherent bias, coupled with their tendency to "hallucinate" or provide confident but incorrect answers (lacking an "I don't know" mechanism), means that AI-generated code often introduces new vulnerabilities or abstracts away critical security decisions, further expanding the attack surface.
6. Need for a Paradigm Shift: Incremental adjustments to existing vulnerability management processes are insufficient. The magnitude of change introduced by AI demands a fundamental rethinking of defensive strategies. Perkal argues for stepping back and conceptualizing entirely new approaches to security in this AI-driven reality, rather than merely patching old methods.

These findings collectively paint a picture of a security landscape undergoing a profound transformation, necessitating a proactive and adaptive response from defenders to avoid being perpetually outmaneuvered.

Technical Deep Dive

▶ Watch: Double-edged sword: AI for offense and defense (10:00)

The technical underpinnings of the AI arms race, as detailed by Perkal, revolve around the remarkable capabilities of modern AI models and the inherent challenges they pose to traditional security paradigms.

On the offensive front, Large Language Models (LLMs) have demonstrated a startling ability to automate and scale attack operations. A key technical finding highlighted is the April 2024 research demonstrating LLM agents capable of exploiting one-day vulnerabilities. Specifically, GPT-4 achieved an 87% success rate in exploiting known flaws merely from their CVE descriptions, at an astonishingly low cost of less than $9 per vulnerability. This capability signifies a shift from human-driven exploit development to automated, on-demand weaponization of public disclosures.

Beyond known vulnerabilities, AI is proving adept at discovering zero-day exploits. Google's Project Zero showcased this with their Big Sleep project in November 2024. By integrating AI with advanced fuzzing techniques, Big Sleep autonomously identified and exploited a previously unknown vulnerability in SQLite. This marked a significant milestone, demonstrating AI's capacity to transcend the limitations of human intuition and pattern recognition in complex codebases.

The most recent and perhaps most alarming development, weeks prior to Perkal's talk, was the Mitis leak. This leak revealed a 100x jump in AI's ability to write working exploits, with success rates soaring from less than 1% to 70%. This dramatic improvement meant AI could not only identify vulnerabilities but also reliably craft functional exploits for them. Notable examples included a 27-year-old bug in OpenBSD and a 17-year-old vulnerability in FreeBSD, underscoring AI's power to unearth deeply buried flaws. The emergence of Small Language Models (SLMs) capable of replicating similar results further democratizes these advanced offensive capabilities, making sophisticated attacks accessible to a broader range of threat actors.

However, the proliferation of AI-generated code introduces its own set of technical security challenges. Perkal emphasizes that LLMs are fundamentally optimized for functionality, not security. Their training regimens and evaluation metrics prioritize whether a piece of code "works" rather than its robustness against attacks. This leads to several issues:

• Increased Attack Surface: The ease with which AI can generate code, often by individuals without security expertise, leads to a massive increase in the sheer volume of software. This expanded codebase inherently broadens the potential attack surface.
• Insecure Code Generation: LLMs, lacking an inherent "security incentive," frequently produce code that contains vulnerabilities. They are not rewarded for secure coding practices or for admitting "I don't know" when confronted with security decisions, often leading to confident but flawed solutions.
• Abstraction of Security Decisions: When users leverage AI to build applications from high-level prompts, critical security decisions regarding backend architecture, dependencies, authentication mechanisms, and data constraints are often abstracted away. This offloads significant security responsibility onto the underlying AI models or the frameworks they utilize (e.g., Lavavel, base 44), leaving users unaware of or unable to control crucial security postures.

This technical landscape, characterized by rapidly advancing offensive AI and inherently insecure AI-generated code, creates a perfect storm for defenders. The challenge is not merely dealing with more vulnerabilities but grappling with a fundamentally altered threat model where automated, intelligent adversaries can discover and exploit flaws at unprecedented speed and scale.

Demo / Proof of Concept

▶ Watch: Defensive strategy: Context engineering for AI (24:00)

While Yotam Perkal's talk did not feature a live, interactive demonstration of Pluto Security's tools or a direct proof of concept by the speaker, it extensively referenced and built upon several well-documented and impactful proofs of concept and research findings from the broader security and AI communities. These examples served to underscore the immediate and tangible impact of AI on both offensive and defensive security capabilities.

Perkal cited the research demonstrating LLM agents exploiting 87% of known vulnerabilities from CVE descriptions for under $9, effectively showcasing a powerful proof of concept for automated one-day exploit generation. He also highlighted Google Project Zero's Big Sleep, which served as a proof of concept for AI's ability to discover and exploit unknown (zero-day) vulnerabilities, specifically in SQLite. Furthermore, the talk referenced the dramatic findings from the Mitis leak, which acted as a large-scale proof of concept for AI's vastly improved capability in writing working exploits, detailing its success against decades-old vulnerabilities in OpenBSD and FreeBSD. These external proofs of concept were integral to Perkal's argument, illustrating the current state-of-the-art in the AI arms race and providing concrete examples of the capabilities defenders must contend with.

Defensive Implications

▶ Watch: Deception techniques for AI attackers using their limitations (31:00)

In the face of an AI-accelerated threat landscape, Yotam Perkal outlined several critical defensive implications and strategies, emphasizing that a paradigm shift, not incremental adjustments, is required.

1. Prioritizing with Context Engineering: With the signal-to-noise ratio worsening and an overwhelming volume of inbound vulnerability reports (both "slop" and genuine findings), context engineering becomes paramount. Defenders must develop scalable methods to feed relevant context to AI systems, enabling them to prioritize effectively. This includes data on reachability, exploitability in specific environments, business criticality, and exposure. Tribal knowledge, traditionally residing in human heads or disparate spreadsheets, must be formalized and made machine-readable for AI to assist in triage and resource allocation. The focus must shift from merely identifying more vulnerabilities to efficiently addressing the most critical ones.

1. Focus on Remediation, Not Just Discovery: Perkal stressed that simply finding more vulnerabilities with AI won't solve the problem if remediation processes remain slow and human-dependent. The true potential for defensive AI lies in improving the speed and efficiency of fixing identified issues. This means AI needs to be leveraged not just for scanning and reporting, but for generating remediation advice, suggesting code fixes, and automating parts of the patching workflow to alleviate the human bottleneck.

1. Securing the AI Supply Chain and Trust Systems: The increasing prevalence of AI in development and operations introduces new supply chain risks. Defenders must establish robust trust systems around Managed Compute Platforms (MCPs), AI skills, open-source and proprietary models, AI browsers, and coding agents. As AI becomes a primary target for attackers seeking the weakest link, protecting AI-related pipelines and components is crucial. This involves developing governance, visibility, and best practices similar to those established over decades for traditional software packages, but at an accelerated pace for AI components.

1. Shift to Root Cause Analysis and Hardening: Given that AI can autonomously discover and exploit unknown vulnerabilities, focusing solely on specific CVEs or managing a backlog of known vulnerabilities is insufficient. Perkal advocates for a conceptual shift towards addressing root causes and systematic issues. Defenders must harden their environments comprehensively, assuming that attackers are already using AI. Threat modeling must evolve to account for AI-powered adversaries capable of discovering and exploiting flaws that are not yet public. This proactive approach aims to reduce the overall attack surface and mitigate entire classes of vulnerabilities, rather than playing an unwinnable game of whack-a-mole with individual bugs.

1. Leveraging AI for Deception: A novel defensive strategy involves exploiting the inherent characteristics and limitations of AI attackers. Perkal suggests using deception tactics specifically designed for AI agents. Unlike human attackers who quickly recognize misdirection, an AI agent, which treats every strong signal as valid data, can be led down rabbit holes. For example, creating breadcrumbs like important_password.txt files that redirect to other decoy files can consume an AI's resources and time, diverting it from actual assets. Understanding AI's capabilities and drawbacks – its literal interpretation, probabilistic nature, and lack of human intuition – allows defenders to design environments that confuse, delay, or misdirect automated attacks.

1. Proactive AI Adoption for Defense: Ultimately, Perkal argues that defenders must use the same tools as attackers. If AI can find vulnerabilities in an environment, then defenders should proactively deploy AI to find those same vulnerabilities first. Investing resources in using AI to improve security posture, harden systems, and identify weaknesses before malicious actors do is not just an option but a necessity to gain an edge in this arms race. This requires a willingness to embrace new technologies and rethink established security practices with fresh eyes.

Key Takeaways

• The Time to Exploit Has Collapsed: AI has drastically shortened the window between vulnerability disclosure and exploitation, demanding immediate and scalable defensive responses.
• AI Empowers Attackers and Defenders Asymmetrically: While AI is a double-edged sword, attackers currently hold an advantage due to fewer constraints and faster operational cycles.
• Traditional VM Strategies Are Obsolete: Incremental defensive measures are insufficient; a fundamental paradigm shift is required to address AI-driven threats.
• Focus on Context and Remediation: Defenders must prioritize making relevant context available to AI for efficient prioritization and shift focus to improving remediation processes, not just vulnerability discovery.
• Secure the AI Supply Chain: The proliferation of AI components introduces new supply chain risks that require immediate attention and robust trust systems.
• Embrace Root Cause Analysis and AI Deception: Move beyond individual CVEs to systemic hardening and explore AI-specific deception tactics to misdirect automated attacks.
• Defenders Must Proactively Adopt AI: To win the arms race, security teams must proactively leverage AI tools to identify and mitigate vulnerabilities before attackers can exploit them.

About the Speaker(s)

Yotam Perkal is the Security Research Lead at Pluto Security, an AI security startup based out of Israel. A passionate advocate for advancing cybersecurity, Perkal is known for his deep insights into the evolving threat landscape, particularly at the intersection of artificial intelligence and vulnerability management. He frequently contributes to the security community, considering VulnCon one of his favorite conferences. His work focuses on understanding the capabilities and limitations of AI in both offensive and defensive contexts, aiming to equip organizations with the knowledge to navigate this rapidly changing domain.