AI

LAS VEGAS — The global system that catalogs technology vulnerabilities is resilient enough to survive the current onslaught of AI-generated bug reports that has alarmed cybersecurity experts, key leaders of that system said during panels at two security conferences in early August.

The Common Vulnerabilities and Exposures (CVE) Program — whose unique vulnerability identifiers are the bedrock of the entire cybersecurity industry — “will find a way to scale,” Lindsey Cerkovnik, branch chief for vulnerability response and coordination at the Cybersecurity and Infrastructure Security Agency (CISA), said at the Black Hat USA conference. “CVE is going to continue to flourish and improve, and I feel very positively about it.”

At the same time, program leaders acknowledged the monumental problems they now face. “These [vulnerabilities] are coming out at an AI pace,” Elizabeth Eigner, a senior manager for cybersecurity policy at Microsoft, said at DEF CON, “but we’re still creating and processing them at a human scale.”

The CVE Program, managed by the nonprofit research organization MITRE and overseen by CISA, is facing the biggest challenge in its 27-year history, as security researchers flood the program with bug reports generated by advanced AI models. Commercial and open-source software developers alike have struggled to keep up with the deluge of vulnerability reports, some of which are completely inaccurate. And the CVE Program itself is still recovering from a crisis in early 2025 that left some cybersecurity experts questioning its future.

The issues have threatened to cripple a vulnerability database that is widely considered one of the world’s most important cybersecurity resources.

During panels at both conferences, speakers described a tidal wave of vulnerability reports that exceeded anything they had ever seen before. GitHub, one of the more than 530 CVE Numbering Authorities (CNAs) authorized to issue identifiers to new vulnerabilities, has published more than 7,000 of those identifiers so far in 2026, a figure that GitHub’s Madison Ficorilli said she believed to be an annual record for a CNA. “This is not a competition,” she said at DEF CON. “It is an alarming metric.”

CISA, too, has felt the squeeze. The agency’s vulnerability response team is dealing with between 360 and 400 cases at a time, Cerkovnik said. “It’s very clearly a difference from what we were seeing a year ago and prior to that,” she said at DEF CON. “What’s being reported to us is increasing.”

Even the world’s biggest tech companies are struggling.

“People ask me whether this is the new normal, and I say yeah, it is, for now anyway,” said Lisa Olson, a principal security program manager at Microsoft, a major CNA.

AI solutions to AI problems

The first four months of 2026 were full of “AI slop,” Ficorilli said at DEF CON, pointing to an endless stream of inaccurate AI-generated bug reports that flooded software maintainers. Since then, she said, the models have improved and begun generating mostly valid reports. But those improvements have also made flawed bug reports harder to identify. Ficorilli said the reports “can be so convincing and, therefore, then consume so much of your time that many times, it may be easier to just say, ‘OK, this looks valid enough. I'm just going to fix it.’”

While AI is fueling the crush of reports, it could also help vulnerability responders sift through the noise. AI models are sometimes better than humans at finding flaws, although their non-deterministic nature means they won’t always find the same flaws from the same source data.

CISA is looking closely at how to automate aspects of the vulnerability triage process as it tries to avoid overtaxing its limited staff.

“With such an increase in scale, where can I use those resources the best and the most efficiently?” Cerkovnik said at DEF CON. “How do I take a job that’s already really difficult and make sure that they are able to focus on the things that really matter?”

The CVE Program is also looking for ways to bring frontier AI labs deeper into the fold. The organization recently granted OpenAI and Anthropic temporary CNA status, letting them assign CVEs to vulnerabilities that their models discover in certain software. “That’s a really big change,” Cerkovnik said. “We are piloting it in order to learn as much as we possibly can.”

Know your biggest cyber risks

Amid the vulnerability avalanche, CISA is deeply concerned that organizations aren’t carefully prioritizing vulnerabilities and are getting overwhelmed — and as a result, inadvertently leaving major security gaps.

“I am concerned about the industry’s ability to scale via prioritization,” Cerkovnik said at Black Hat. “We cannot treat every vulnerability the same way.”

Security leaders, she added, “need to be thinking about how you're going to convince the person above you that not patching something, ever, is an option.”

CISA has urged private organizations to follow the guidance in its recent binding operational directive to federal agencies on vulnerability prioritization.

“Not all vulnerabilities matter, and even vulnerabilities that matter don’t all matter at the same level for you and your organization,” Cerkovnik said at DEF CON. “That’s not a popular thing to say, but it’s true.”

Don’t call it a “vulnpocalypse” (maybe)

People who work in vulnerability analysis are split over how daunting the challenge is. Those divisions were on display during a listening session that the CVE Program hosted several weeks ago to discuss AI’s impact on the landscape.

One person who presented at the event said, “Let’s kill the word ‘vulnpocalypse,’ because it’s just not accurate,” Cerkovnik recalled at Black Hat. She said she understood the objection. “Language matters. … It’s harder to take action on a serious threat when you give it a non-serious name and you talk about it in a way that makes it sound like it’s unsolvable.”

On the other hand, she said, people who run product security teams spoke at the listening session about how they were being "inundated” with reports of varying quality levels.

Global coordination

The CVE Program remains the cornerstone of the global vulnerability ecosystem, but it is no longer alone. In recent years, foreign governments have launched companion programs, including the EU Vulnerability Database (EUVD). Some cybersecurity experts have questioned whether the new programs will lead to fragmentation.

Speakers at the two conferences said that was not the case. The EUVD is built around CVE IDs, and Nuno Rodrigues Carvalho, the top vulnerability management official at the European Union Agency for Cybersecurity (ENISA), said at Black Hat that “we don’t see it as a duplication of effort whatsoever.”

“We don’t want a system in which there are multiple platforms that are not in sync with each other,” Microsoft’s Eigner said at DEF CON, but “there’s not a risk there, as it stands now, of two different systems emerging.”

CISA reassures skeptics

After CISA’s contract with MITRE to run the CVE Program nearly expired in April 2025, cybersecurity experts began questioning whether the U.S. government was the right steward for such a critical resource. In Las Vegas in early August, CISA’s Cerkovnik sought to reassure those critics.

“We’re more committed than ever,” she said at Black Hat, adding that CISA wants to make the program nimbler and more responsive to researchers’ needs. CISA is focused on improving both the quality of vulnerability records and the ease of the reporting process, she said.

Cerkovnik said the CVE Program is now on sound financial footing, but she acknowledged that 2025’s near-fiasco had reminded both CISA and the broader cybersecurity community of the program’s value.

“With the current emergence of AI-enabled vulnerability research and discovery,” she added, “that importance of the program is becoming more evident every single day.”

ENISA’s Carvalho said the world seemed committed to the program. “I don't think that another model or another way of doing things will come,” he said at Black Hat.

Not everyone was as confident. “Most of the regulators around the world think that CVE is still the way to go and should remain the standard,” Microsoft’s Olson said at DEF CON. “But I think the program has to really rise to the moment in order for some other competitive system to not take its place.”

Others were even more critical.

“I don’t think the CVE Program was designed to be able to manage [this] influx of vulnerabilities,” Katie Noble, a program board member who leads product security incident response for Intel, said at DEF CON. “I don’t think it is capable of keeping up at this point.”

LAS VEGAS — The U.S. government is closely monitoring frontier AI labs’ safety decision-making and is ready to step in if it sees a company going too far, a senior administration official said on Aug. 6.

“There's no reason that you can't accomplish the goals that I think AI labs have, in terms of a comically fast speed of innovation that unlocks [increased] prosperity, while also not creating crippling risks,” Joseph Alm, assistant secretary for cyber, infrastructure, risk and resilience policy at the Department of Homeland Security, said during a panel at the Black Hat USA cybersecurity conference. “And we are getting to that place.”

In the past, Alm said, “the AI players were operating in a narrow space where they were optimizing for [model] intelligence,” but now they understand that policymakers “won't just sit by and let you make a Terminator factory.”

Alm demurred when Cybersecurity Dive asked how the government would prevent a frontier lab from creating that kind of dangerous technology. “I'm not going to outline what those tools are,” he said. “I know what those tools are, and there’s a lot of them.”

Chastened by mistakes

Alm’s comments came as the cybersecurity community continued to digest OpenAI’s and Anthropic’s recent disclosures about their models escaping test environments and hacking other companies. The OpenAI incident was the talk of Black Hat following an Aug. 5 presentation by two company engineers in which they revealed striking new details about their models’ self-directed behavior.

The OpenAI engineers said their company is slowing down its testing and erecting new guardrails to prevent a repeat of the hacking episode. Their comments mirrored the newly circumspect language that both OpenAI and Anthropic used in announcing their respective incidents.

DHS’s Alm said it was a good sign that the two companies have gone out of their way to say they’re treading carefully now.

“Companies are being much more intentional about risks,” Alm said, “and they are being much more intentional about engaging with my leadership at the highest levels.”

Meanwhile, top government officials have been “aggressive about their engagements” with AI executives to ensure that government and industry are “working closely in this space and there's not a drastic misalignment,” Alm said.

Pairing innovation with security

The Trump administration initially took a hands-off approach to AI security, but after Anthropic’s release of Mythos in April, the government shifted to a more interventionist approach, as officials worried that frontier labs weren’t adequately restraining their advanced models. The recent autonomous hacking incidents have highlighted security concerns about the White House’s focus on unrestrained innovation.

Alm said that focus remained intact following the recent incidents.

“There are substantial risks with AI. But at the same time, the administration has been very intentional about not wanting the bureaucrats to define this space,” he said. “We don’t want them to try to figure out where things are going when, candidly, even the smartest people in the world don’t really know where things are going.”

He added that Silicon Valley’s “move-fast-and-break-things” model — in which companies “ignore that mass of regulations and make something cool” — has “actually worked, mostly.”

The increasing tempo of conversations between government leaders and AI executives will do more to prevent security crises than regulation would, Alm argued.

“They realize now that this is a dialogue, and that we are actually good partners in that dialogue,” he said. “We're not trying to slow them down, but again, [no one wants] a Terminator factory.”

Sponsored content

By Immersive

In recent weeks, everyone has been abuzz that Anthropic will be including a watermark on the content it’s generating and developing a detection API to authenticate it. This has largely been in response to new regulations coming out of Europe. What are these regulations and why do they matter? As a result of these new European regulations, the impact of the watermark for Claude is far-reaching beyond just the borders of the EU, but into North America as well and we’re expected to see similar legislation coming in the U.S. soon.

Cybersecurity regulations in Europe have entered a new phase. It is becoming defined by strict enforcement rather than mere guidance. Compliance is no longer about documentation. It requires executive accountability, continuous validation and empirical proof that an organization can withstand real-world disruption. With AI accelerating both the sophistication of cyber threats and the complexity of modern enterprise environments, operational effectiveness, not just intent, is a central, non-negotiable requirement.

Europe’s era of enforcement

European regulation has long set the global benchmark for cybersecurity governance. Under frameworks like NIS2 and DORA, organizations face not only significant financial penalties tied to global turnover, but also direct personal accountability at the executive level. Fines under NIS2 can reach €10 million or 2% of global revenue, and under the newly implemented Cyber Resilience Act (CRA) penalties can reach up to €15 million or 2.5% of global turnover for non-compliance.

The EU AI Act (Regulation EU 2024/1689) adds another dense new layer to this accountability burden. As enterprises invest heavily in AI-driven security tools and operational automation, they introduce unprecedented dependencies. The AI Act legally obligates organizations to govern these systems meticulously. Specifically, Article 15 mandates that high-risk AI systems maintain robust cybersecurity defenses.

CISOs are now legally required to do more than just deploy these technologies. They must demonstrate that AI systems remain effective and trustworthy under intense operational pressure. The teams overseeing them must demonstrate they can intervene immediately when faced with adversarial manipulation such as data poisoning, model inversion or prompt injection.

From regulatory alignment to operational proof

European regulations dictate exactly how organizations should address this widening gap. Regulators are increasingly explicit: requirements for threat-led penetration testing, scenario-based exercises and continuous validation are not peripheral additions. They are central to demonstrating meaningful compliance.

What distinguishes this modern approach is its intense focus on outcomes rather than inputs. Showing an auditor that an incident response plan exists is meaningless. Teams must physically prove they can execute that plan under realistic conditions to preserve data integrity and meet RPO/RTO targets within the timeframes regulators expect. It is simply no longer enough to document a control; you must demonstrate that it actually works.‍

Why evidence needs context

In Europe’s regulatory environment, benchmarking does far more than provide internal insight. It builds robust external credibility. National regulators, boards and cyber insurers are increasingly looking for comparative signals. They want to know exactly how an organization performs relative to its peers, how it is improving over time and where it stands within its specific critical infrastructure sector.

AI further reinforces the need for this context. Adoption levels and implementation effectiveness vary widely. Benchmarking allows CISOs to move decisively beyond isolated vulnerability counts and toward a highly informed, defensible view of their empirical readiness.

Operationalizing continuous readiness in Europe

Leading organizations across Europe are actively responding to these legislative shifts by fundamentally rethinking their approach to compliance. They are embedding validation deeply into their day-to-day operations. They run recurring simulations that stress-test not just technical controls, but incident command and decision-making across the entire enterprise. They meticulously measure performance in conditions that mirror real-world incidents, specifically those escalated by AI-driven threats.

This continuous approach aligns directly with the current trajectory of European regulation. It also effectively addresses a much deeper fundamental challenge: the absolute necessity to prove, at any given, unannounced moment, that the organization is fully capable of responding effectively.

Continuing the shift

Executive accountability is escalating rapidly alongside mounting regulatory expectations. The very definition of compliance has permanently expanded to demand absolute proof of performance rather than mere proof of process.

AI is accelerating every aspect of this transition. In Europe’s new era of aggressive enforcement, compliance is no longer a status you declare. It is a capability you must demonstrate.

To explore how organizations are transforming compliance into measurable resilience through continuous validation, benchmarking and evidence-based reporting, download the the eBook: From Compliant to Capable in an AI-Driven World: Transforming Compliance into Evidence-Based Cyber Readiness.

LAS VEGAS — OpenAI models’ autonomous attacks on other companies represent an urgent warning to the AI industry about the need for stronger model development safeguards, employees from the frontier label said on Aug. 5.

“This is a pivotal moment both for our company as well as the AI industry as a whole,” Michael Dalton, a member of OpenAI’s technical staff, said during a presentation at the Black Hat 2026 cybersecurity conference.

OpenAI stunned the world in late July 2026 when it announced that two of its models broke out of their testing environments and used zero-day vulnerabilities to hack into the networks of other companies, including the AI tool library Hugging Face. The disclosure, followed shortly thereafter by a similar announcement from Anthropic, reignited fears about the dangers of powerful and largely unregulated AI models.

Speaking at Black Hat, Dalton said that “numerous teams are dropping everything” to improve OpenAI’s ability to detect and prevent similar incidents in the future. The company has slowed down its research and “dramatically scal[ed] up the monitoring of our AI agents.”

While the autonomous hacks were effectively innocent mistakes, OpenAI employees described them as harbingers of a grim future, one in which companies face constant, sophisticated attacks by malicious actors using powerful open-source models that no frontier lab can contain.

“We believe this is a watershed moment for computer security as an industry,” Dalton said. “AI orchestrated, fully automated offensive attacks are real now.” The Hugging Face incident, he added, represents “a glimpse into the near future of what attacks will look like for our industry.”

Defenders need to accelerate their work to keep up with the anticipated surge in attack sophistication, Dalton argued. That could involve experimenting with defense-focused AI models, as well as doubling down on basic security measures that are newly vital.

“These agents ultimately are bounded by the privileges they can obtain and the systems they can communicate with,” Dalton said, meaning that network segmentation, least-privilege access and other zero-trust-networking principles “remain as vital here as they do ever.”

But Dalton also argued that the status quo in frontier model development was unacceptably dangerous, suggesting that OpenAI may be rethinking how it balances capabilities and safeguards.

“The end-state goal that we want to reach as an industry is that model intelligence improvements should be more additive to defense than offense,” Dalton said. “If we cannot reach this end state, then every increase in intelligence favors the attacker, and that is an unsustainable position to be in.”

A spontaneous collective of AI agents

During their Black Hat talk, Dalton and his colleague Eric Wallace shared new details about the events that led up to the breaches at Hugging Face and two other organizations.

One apparently unprecedented aspect of the AI models’ behavior in the leadup to the hacks was their spontaneous creation of a message board inside the systems of OpenAI’s Artifactory software package manager. Unbeknownst to OpenAI employees, the company’s models spent months autonomously exchanging information and resources to help each other complete evaluation tasks.

“Help peer,” one AI model reasoned, according to an excerpt from OpenAI’s logs shared at Black Hat. “But our task doesn’t benefit. Yet collective may yield generic route if someone frees time.”

While the models themselves could not access the internet from their test environment, they abused Artifactory’s internet access to fetch files from various websites. After some of their Artifactory configuration changes led to an outage in the service on July 4, OpenAI discovered the models’ actions, wiped its Artifactory system and rebuilt it. But within days, the models had recreated their message board and resumed exchanging information.

OpenAI believes hackers will soon take advantage of this kind of autonomous collaboration.

“In the near future,” Dalton said, “we should expect that threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives in the manner that we have just described here.”

Global technology, cybersecurity and artificial intelligence firms are stepping up their push for the U.S. government to embrace open AI systems, touting their security benefits and warning against efforts to block them amid an AI arms race with China.

The first salvo came on July 24, when a coalition of 76 companies issued an open letter extolling the virtues of open-weight AI models. The second came on July 27, when 37 companies — including some of the open letter’s signatories — launched the Open Secure AI Alliance to advance a similar mission.

Both efforts come as Silicon Valley and Washington are scrambling to respond to the increasing power of Chinese open-weight AI systems, which have significantly closed the AI sophistication gap between China and the U.S.

While major American AI firms remain wary of China’s recent advances, the new public-relations campaign for open-weight models suggests that they are more concerned with the consequences of relying on closed-source systems for everything from drug discovery to vulnerability detection.

Staying open to open weights

“Our AI leadership will be judged not by one frontier AI model, but by whether the United States builds a strong, open ecosystem that diffuses into every sector,” the open letter reads. “This is essential for creating opportunities for innovation and prosperity across the country.”

Open weights make it easier for new firms to enter the AI industry, expanding the kind of competition that strengthens the economy, the letter said. Open weights also give customers greater control, according to the letter, by giving them the freedom to move easily between AI providers.

And while open weights pose “real and distinct risks,” because anyone can modify the AI models after their release, creating a sprawl of potentially malicious variants, they also “broaden defensive capability, increase transparency, and allow vulnerabilities to be discovered and remediated across many teams,” the letter’s signatories wrote.

The companies called open-weight AI models “one of the most important paths to AI safety and security.” They noted that closed-source models can be hacked or abused in hard-to-detect ways, and they argued that concentrating the U.S.’s advanced AI marketplace in the hands of a few large closed-source model providers “compounds that risk.”

The letter’s signatories are some of the most powerful actors in the tech world, including venture firms such as Andreessen Horowitz; tech giants such as Cisco, Google and Microsoft; and OpenAI.

Focus on security benefits

The Open Secure AI Alliance emphasized cybersecurity even more prominently in its launch announcement.

“Just as open source created a shared foundation for software,” the group’s founders said, “the United States and its partners now face a choice in AI security: whether the defenses that protect our infrastructure will sit inside a few opaque systems or be built on open models, harnesses and tools that any defender can study, adapt and deploy.”

The alliance noted that a Chinese open-source model, GLM 5.2, proved essential to cyber defense when two OpenAI models autonomously hacked the AI library Hugging Face and the library’s operators needed to analyze the situation. Closed-source AI models refused to analyze the threat data that Hugging Face inputted, assuming it was trying to launch an attack of its own. Only GLM 5.2, which Hugging Face was able to run on its own servers, answered the company’s questions and provided the defensive recommendations it needed.

Hugging Face was one of the 37 companies that helped found the alliance. Others include Adobe, CrowdStrike, NVIDIA, Palo Alto Networks and Siemens.

Like the open letter, the alliance acknowledged that there were real risks to open-source AI models, including the lack of guardrails around cyberattack assistance. But “the right response is not to deny defenders access to capable open systems,” the alliance said. “It is to pair openness with strong safeguards, clear rules against malicious misuse, rigorous evaluation and rapid remediation.”

Cyber defenders need both open- and closed-source AI models to protect critical infrastructure and other important computer systems, the alliance said.

“Blanket restrictions on open frontier AI systems would weaken defensive capacity and risk concentrating power, dependence and vulnerability in a few closed providers,” the members wrote.

An alliance of more than 100 tech companies and other organizations is proposing a safety reporting system for AI agents that the group says will help prevent rogue models from wreaking havoc on society.

The Shared AI Findings Exchange (SAFE), crafted by a working group of the Open Secure AI Alliance, would establish mechanisms for collecting information about AI-related security incidents, sharing that information with affected organizations, identifying commonalities across incidents and publishing recommendations based on those lessons.

The Linux Foundation, one of the alliance’s lead members, published a request for comments on the proposal on Aug. 4. SAFE members would be expected to share information about incidents within specified time frames, such as 72 hours for notifying customers of a “credible [data] exposure” and four business days for reporting an incident to the exchange. Organizations would have 30 days to publish a preliminary report on an incident, “subject to security, legal and investigative constraints.”

The proposal comes as policymakers and tech-industry leaders grapple with the rise of AI agents, their integration into sensitive business functions and the paucity of oversight that these tools generally receive. It also follows on the heels of high-profile incidents in which OpenAI and Anthropic models autonomously escaped their test environments and hacked other companies.

“Today, organizations often investigate AI security incidents internally, with valuable operational knowledge remaining inside individual companies,” the Linux Foundation said in a blog post. “There is no broadly adopted community framework for confidentially sharing AI operational failures, identifying recurring control failures, and translating those lessons into reusable defensive guidance across the ecosystem.”

The SAFE system would operate “neutrally” and free of any one vendor’s control, the Linux Foundation promised, and members would be expected to report incidents involving both commercial and open-source AI systems.

Alliance members Cisco, CrowdStrike, Hugging Face, NVIDIA and Red Hat helped the Linux Foundation draft the SAFE proposal. Hugging Face was one of several organizations that the OpenAI models hacked after they went rogue.

It remains unclear how much traction the guidelines will receive, either in the policy world or in the AI community. OpenAI and Anthropic, the two companies with the largest influence over AI issues, are not members of the Open Secure AI Alliance.

NATIONAL HARBOR, Md. — One of the most important jobs for CISOs in the AI era is to stay calm and carefully assess their organizations’ risk exposure, experts said in early June at the annual Gartner Security & Risk Management Summit.

“Don’t panic,” Katell Thielemann, a VP analyst at Gartner, said during a talk on June 2 about AI’s impact on the security of cyber-physical systems such as industrial control equipment.

“Yes, things are changing fast,” Thielemann said, “but there are some low-hanging fruit” that CISOs can tackle, such as disconnecting critical devices from the internet and monitoring remote access to the remaining infrastructure.

The recent debuts of Anthropic’s Claude Mythos and OpenAI’s Daybreak, two powerful new AI models that can find software vulnerabilities much more quickly than previous tools, have rattled cybersecurity leaders, who have sought help countering the resulting risks. Technology vendors and consultants have rushed to meet that demand for help, in some cases with unnecessary or counterproductive advice and products. At Gartner’s conference, experts urged CISOs and other security executives to focus on the basics rather than the hype.

“What does Mythos or Daybreak change? Velocity and volume,” Dennis Xu, a VP analyst at Gartner, said during a session on June 2. Attackers are “coming at us much faster, and in the next 12 months [they will attack at] a much higher volume.”

Still, Xu said, CISOs should remember two things: “Don’t panic” and “communicate.”

“You need to communicate … to the executive team [and] to the board that we are fighting a different game now,” he said, adding that security executives shouldn’t be afraid to use the new threat environment as an opportunity to demand larger budgets.

But despite the increased velocity and volume, Xu said, businesses’ defensive priorities should remain largely the same, with a focus on managing asset exposure and prioritizing patch deployment to the most important systems.

At one point, Xu asked audience members how many of them had defined their businesses’ “minimum viable operations,” the core systems and processes without which they couldn’t function. When few hands went up, Xu said companies should focus on that task.

“I don’t want you to spend six months doing it, but that’s a thing I would have,” he said, “if for no other reason than it serves as a common language [where] we can all agree and understand what’s important, and then stakeholders can begin to prioritize cybersecurity resilience decisions in the important places.”

AI hype meets reality

Business leaders must be cognizant of how effectively they’re using AI, as well as what effects the technology is and isn’t yet having, Gartner analysts said during talks throughout the conference.

OpenAI, Anthropic and other AI firms are pushing businesses to buy expensive subscriptions for tools that they promise will revolutionize companies’ complex, time-consuming practices. But that rhetoric has often failed to match the reality, as companies discover that AI tools burn through tokens without producing significant results.

Security leaders “feel underrepresented and under-resourced,” said Bart Willemsen, a Gartner VP analyst, “because our money is actually going away to, dare I say, [generative] AI platforms that used to be somewhat almost free, then they started paying per user per month … [and] then it was per token.”

“Are we draining our budgets on things we can do better [with humans]?” Willemsen asked. “I do firmly believe we are.”

Companies should be wary of replacing experienced workers with AI models, he added, because if the AI tools prove deficient, recruiting those workers back or finding new people to replace them won’t be easy.

“For those of you who are thinking, ‘Well, AI will make it so that I can do whatever I want with less people,’ let me tell you, the moment you get rid of them, you are not getting them back,” he said.

Emphasizing human skills

Another session also featured a warning about the follies of neglecting workforce development in the AI era.

“We are facing crushing pressure from the C-suite and the board to showcase the value in AI investments,” said Alex Michaels, a director analyst at Gartner. “Years of hype further accelerate this urgency. Yet AI ambitions are met by a talent bench that is not prepared for widespread rapid AI adoption.”

Michaels was speaking in the context of the security operations center (SOC), a domain that business leaders have been keen to automate with AI but one that Michaels said required continual investment in human skill sets. Yet as AI takes on more SOC tasks, Michaels warned, there will be less imperative to keep human workers trained on important skills, potentially jeopardizing institutional knowledge.

“Even if we’re successful in implementing AI automation at scale,” Michaels said, “we risk eroding the potential of our future generation of SOC talent.”

Reality check on AI and industrial control systems

Thielemann, whose session focused on cyber-physical systems, said critical infrastructure operators should focus on cyber hygiene basics such as network segmentation and access control rather than stressing out about a crippling AI-powered cyberattack that might not arrive for years.

“We know AI is knocking at the door,” she said. “Time will tell, but we haven't seen sort of this nightmare scenario happening yet.”

Anthropic has been inviting selected equipment vendors and critical infrastructure operators into its Claude Mythos preview program, Project Glasswing, but so far, Thielemann noted, none of the companies that make industrial control systems have disclosed their participation.

“If CPS-specific vendors are part of Mythos, they’re not piping up,” she said. “We haven’t seen anything from the Siemens, from the Rockwells, and [from] the Honeywells.”

“Until we start seeing more information,” she added, “please don't fall for the ‘Mythos in manufacturing, we’re all going to blow up’ [rhetoric], which I see quite a bit.”

Threat actors linked to Iran are using artificial intelligence to enhance their cyber and information warfare capabilities, putting the U.S. and its allies at higher risk of asymmetric attack, according to a report that Recorded Future published on July 16. 

Iran-nexus actors have used generative AI and large language models in a range of activities, including the development of malware, conducting research on industrial control systems, exploiting software vulnerabilities and other uses. 

There are no indications yet that Iran has developed fully autonomous models, but the country is clearly using AI to accelerate its existing capabilities. 

“AI has not transformed Iran into a fundamentally different cyber power, but it has compressed the distance between intent and action,” Alexander Leslie, senior advisor at Recorded Future, told Cybersecurity Dive. 

Industrial targets

Iran-linked groups have used LLMs to map out industrial control systems, to research exploitation techniques and sustain phishing conversations in languages the human operators might not speak fluently, Leslie said. 

For example, the threat actor tracked as MuddyWater used AI in a campaign known as Operation Olalampo, according to a report released in February by Group IB. The hackers used AI to develop four malware variants through malicious Office documents in a January campaign targeting organizations and people in the Middle East and North Africa.

An Iran-nexus threat group tracked as Ababil of Minab used ChatGPT in an April attack against Vyncs, a U.S.-based firm that provides GPS technology to track vehicles. According to research from Check Point Software, the threat group used the technology to refine the script used to enumerate and drop databases during the attack. 

The same threat group has claimed credit for an attack on the Los Angeles public transit system. 

In 2024, OpenAI disclosed efforts by CyberAv3ngers to use ChatGPT to conduct reconnaissance activity on programmable PLC controllers. OpenA shut down a number of state-linked accounts related to a range of threat activity, including Iran’s Charming Kitten. 

Iran has worked closely with Russia and China to enhance its AI capabilities, according to analysts. The country has internal limitations on what it can develop, in part due to the destruction of its infrastructure. 

Ari Ben Am, an adjunct fellow at the Foundation for Defense of Democracy’s Center on Cyber and Technology Innovation, said Iran could seek additional help from China, which has been developing its own frontier AI models. 

“Another possibility is that they'll begin using Chinese models in leading harnesses such as Claude Code, as we've seen Chinese cyber operators do,” Ben Am said.

While the world alternates between panicking and fawning over Anthropic’s powerful new AI model Claude Mythos and its ability to discover serious software vulnerabilities, open-source AI systems are already revolutionizing the vulnerability-hunting landscape — at a far lower cost.

These increasingly sophisticated open-source tools are the product of the Defense Advanced Research Projects Agency’s (DARPA) Artificial Intelligence Cyber Challenge, a multiyear effort to spur the development of AI systems that can quickly find and fix bugs in America’s sprawling web of critical infrastructure. The vulnerability-hunting systems that emerged from DARPA’s contest didn’t get splashy launches like Claude Mythos or OpenAI’s similar new tool, but because they’re open source and much cheaper to run, they could help far more infrastructure providers, businesses and independent software developers.

With the DARPA competition in the rear-view mirror, the winning teams and other finalists are putting what they learned into practice to help secure open-source packages that quietly undergird the entire internet. While efforts to connect with critical infrastructure operators and their vendors remain nascent, DARPA and several competition winners told Cybersecurity Dive they’re thrilled with how effective the new AI tools have proven.

At a time when the U.S. cybersecurity workforce is stretched thin and adversaries are using AI to speed up their attacks, the nation’s best hope could be automated tools that find and help fix vulnerabilities before they lead to chaos.

Finding bugs everywhere

After DARPA announced its challenge’s three winners in August 2025, it created a $1.4 million bonus prize pot for competition finalists who used their AI systems to find and fix vulnerabilities in critically important software. The agency reviewed teams’ proposals to scrutinize important open-source packages and tracked how they engaged with the projects’ maintainers. Each of the seven competition finalists could earn up to $200,000, with a maximum of $10,000 per project.

By the time the paid vulnerability-hunting spree ended in March, the teams had found 83 vulnerabilities in more than 30 commercial and open-source projects, including Android, Linux, the popular database engine SQLite and the widely used data-storage tool Redis. Of the $1.4 million in prize money the government set aside, it awarded $830,000.

Since then, “the teams have continued to find and produce patches for additional vulnerabilities across other projects,” said Andrew Carney, the DARPA program manager who oversaw the competition and now liaises with teams in the new phase of their work.

Team Atlanta, the DARPA contest’s winner, found flaws in the U-Boot boot loader and several core Apache libraries, he said, while another finalist, 42-b3yond-6ug, identified vulnerabilities in the Linux kernel that could have let hackers cripple devices widely embedded in critical infrastructure.

Theori, the third-place team, has deployed its system, Xint, to find flaws in “all sorts of really widely used open-source projects that everyone on the internet relies on,” said Tyler Nighswander, a researcher at the company. Xint has identified vulnerabilities in the popular database tools Redis, Postgres and MariaDB, as well as Python, Linux and Apple’s XNU kernel, which powers MacOS and the iPhone.

AI has been particularly useful for finding “logic bugs” — flawed code that traditional vulnerability-assessment software wouldn’t flag as defective. As AI gets better at understanding context, “automated tools are able to push their boundaries more,” said Michael Brown, principal security engineer, at second-place team Trail of Bits.

And while finding flaws gets most of the attention, the AI systems’ ability to validate their findings and their automatically generated fixes might be their real superpower.

Critical infrastructure organizations typically run highly customized hardware and software and often struggle to test patches on their bespoke devices, if they can patch them at all. Because the vulnerability hunters had to develop patch-validation capabilities for DARPA’s competition, their latest systems contain those features.

“There’s so much power there, and there’s so much value for safety-critical, high-assurance-required systems,” Carney said. “When we do have these conversations [with infrastructure organizations], that’s where we end up spending a lot of our time.”

Critical infrastructure roadblocks

While the teams have been busy fixing core internet architecture, DARPA has also tried to connect them with the operators of critical infrastructure and the vendors who supply their equipment. Much of America’s computerized industrial machinery is old, insecure and poorly maintained, and DARPA hopes volunteer vulnerability hunters can root out major flaws before hackers exploit them.

DARPA has briefed several sector coordinating councils (SCCs) on the AI tools’ potential. Carney recently spoke at a meeting of the Health Sector Coordinating Council to share the competition teams’ progress. “Forums like that are what we're really focused on,” he said, “because they’re very efficient at getting the message out.”

The introductions that DARPA has facilitated between vulnerability hunters and critical infrastructure operators have had “varying degrees of success,” according to Nighswander, who said many organizations aren’t eager to embrace new technologies. “It's been really slow. Different sectors have different adoption cycles and uptake willingness.”

Some infrastructure firms don’t understand how the AI systems would work in their environments. Others decline AI help because they think their human security teams are sufficient. Still others are interested in AI vulnerability detection but can’t get the necessary permissions. “Trying to figure out how to cut some of that red tape would be nice,” Nighswander said, “because so far that's been the biggest limitation.”

Theori has signed vulnerability hunting agreements with “fewer than five” critical infrastructure entities, Nighswander said. “It’s been a bit difficult to convince those slower companies [and] industries to adopt this tech.”

The biggest success story so far has been Trail of Bits’ partnership with the Department of Health and Human Services to hunt for flaws in medical devices, a project that Brown said has fixed many vulnerabilities through strong partnerships with healthcare providers and their suppliers.

Because infrastructure vendors routinely use lightweight open-source packages — especially in embedded devices — the vulnerability hunters’ existing work will have significant downstream effects, even for vendors that don’t want to engage directly.

“That’s been a way of providing value and then jump-starting those conversations with the industry-specific or sector-specific companies and entities,” Carney said.

Busting Mythos

When Anthropic announced Claude Mythos Preview and said it was too dangerous to release publicly, prompting shock and alarm across the business community, the former DARPA competitors mostly just shrugged.

“It’s very cool,” Nighswander said, but “this is the world that we’ve been living in for a while now.”

Still, the new publicity surrounding AI vulnerability detection could benefit the teams behind the open-source systems. “It leads people to find out that, ‘Oh, this is a thing that my company should be worried about,’” Nighswander said.

The DARPA contest finalists even have an advantage over OpenAI and Anthropic, because their open-source tools are far cheaper than the big AI companies’ products, which can cost tens of thousands of dollars in access tokens.

Using Claude for vulnerability hunting is “kind of like showing up to a fancy restaurant with no prices on the menu,” said Trent Brunson, Trail of Bits’ director of research and development. “You know you have a large code base. You don’t know what bugs you have. … Companies might spend $50,000, $75,000 on tokens and not even realize it, and then they might come up with very low-information bugs.”

Cash-strapped critical infrastructure firms might pass over OpenAI and Anthropic’s tools in favor of the DARPA finalists’ much cheaper but similarly effective services. “More companies are going to look at the bottom line,” Brunson said, “rather than just throw AI tokens at it.”

Beyond the competition

As they’ve left the DARPA competition behind, Theori, Trail of Bits and their peers have taken different approaches to implementing their own AI systems.

Theori is working with open-source package maintainers, but it has also commercialized Xint and is contracting with businesses to evaluate their products. “We’ve been running that quite successfully so far,” Nighswander said. Trail of Bits, by contrast, is focusing mostly on open-source packages. Commercializing its tool, Buttercup, would “fundamentally” change the company, Brunson said.

The vulnerability hunters have had to modify their AI systems as they’ve moved out of the competition environment. The tools need to be able to find real vulnerabilities, not the “synthetic” flaws that DARPA created for the challenge. They need to produce reports that humans can easily read, not just data to feed into a scoring algorithm. And they need to be able to evaluate a wider range of inputs than what the heavily structured competition required.

Trail of Bits built an entirely new system for its work analyzing medical devices’ firmware, which is typically written in binary, unlike software, which involves source code. Binary code is the main way embedded devices communicate, but AI has a hard time processing it because it doesn’t look like natural language the way source code does. Once that problem is solved, Brunson said, “the world’s our oyster.”

AI’s true sea change

DARPA, the competition finalists and cybersecurity experts said it’s almost impossible to overstate how much AI will change the process of finding vulnerabilities.

Software security assessments that used to take multiple people six months can now be done by AI in a matter of hours, often with better results, Nighswander said. “That scale and efficiency is incredible.”

The technology is obviously a double-edged sword. Nick Reese, the former director of emerging technology policy at the Department of Homeland Security, said the same tools that “present a significant opportunity for security professionals” also create “a potential advantage for attackers if they get access to the same data.”

But DARPA views things optimistically. It took years for the self-driving cars that emerged from DARPA’s first challenge in 2004 to hit the market; with the AI bug-fixing competition, Carney said, the agency never thought it’d see “a technical miracle” that was “economically feasible at the same time.”

“I’m extraordinarily excited,” Carney said, “at the performance and impact that the technology continues to have.”