Adrian Sampson

Associate Professor

Adrian Sampson, associate professor of computer science at Cornell University, studies programming languages and computer architecture.

Sampson says:

“AI-powered vulnerability scanning is a serious risk, and Mythos is just the next step in ratcheting up that risk. 

“All software has bugs, and most software has serious security bugs. You just have to find them. Until recently, it was very expensive to search for exploitable security bugs. There was a sort of equilibrium: ‘white hat’ software vendors spent money and engineering time on both searching for vulnerabilities and implementing broad mitigations; ‘black hat’ attackers spent their resources only on the former. But the vendors generally had more resources in aggregate. Everyone in the tech sector has an incentive to invest in securing foundational open-source technologies like Linux, and that vastly outweighs the investment that any individual attacker can muster.

“We should all be worried that AI-powered attacks will upset this balance. It could make it much, much cheaper to find new vulnerabilities that no one else knows about. I think you can make the case for two possible futures: a much broader set of lower-budget attackers can launch plausible attacks, so we're doomed. Or, well-resourced software vendors have access to the same tools, so they can find and fix these vulnerabilities just as easily, so a new equilibrium will emerge.

“I think it's clear that the reality will be some messy combination of these two stories. A reasonable guess would be that we're about to undergo a period of chaos where scary vulnerabilities are discovered and exploited far more rapidly than they have in the past. But after finding lots of bugs and forcing them to be fixed, the new tools will reach a point of diminishing returns, and the white hats will have a chance to catch up. It could be temporary, but it seems like some chaos is inevitable.”