🤖New CSET Blog

How is AI starting to impact the software vulnerability lifecycle?

@chrisrohlf.bsky.social breaks down the automation of the discovery, patching, and exploitation phases. cset.georgetown.edu/article/ai-a...

AI + cyber articles have an extreme lack of imagination. Where are the tabletop exercises for nation state APTs silently tampering with SentencePiece tokenizer implementations introducing backdoors into normalization logic …

An interesting, and possibly intentional, side effect of interpreting the BIS rule in this way is that it deters most capable companies and individuals from contributing any development or support of Huawei’s Ascend CANN stack within open source AI compilers.

Playing with OpenAI's o3-mini-high tonight. Here is the model analyzing a slightly modified crackaddr.c

These reasoning models are a game changer for non-agentic based AI driven code analysis

chatgpt.com/share/679d79...

We sat down with Nicholas Carlini and talked about his work attacking the mathematical underpinnings of LLMs, including remote oracle attacks that extract weights from closed foundation models. Crypto-type exploits that are not about cryptography:

securitycryptographywhatever.com/2025/01/28/c...

he Deepseek v3 paper is impressive and the discussion surrounding it is fascinating. I find these results raise more questions for me than they answer. Here are a few random questions and thoughts I have after reading through the paper:

Not sure how much I'll use this platform but here are some recent short pieces I recently wrote on AI and Cyber

AI Replication
struct.github.io/ai_replicati...

AI+Cyber & the Security Dilemma
struct.github.io/ai_security_...

LLM Emergent Abilities & Weird Machines
struct.github.io/emergent_abi...