Security Researcher Discusses AI Agents and the Future of Vulnerability Research
· 31:05 · Watch on YouTube ↗
Summary
A security researcher describes how AI agents can test suspected vulnerabilities, reports finding over 1,000 Linux kernel bugs with his team, and argues that human expertise remains essential.
Key points
- The researcher says agents can run software and test suspected vulnerabilities, helping filter false positives from language-model analysis.
- His team reports finding over 1,000 Linux kernel vulnerabilities triggerable by unprivileged local users, with discoveries outpacing reporting.
- The team says a designed workflow and attention to vulnerability properties increased its findings from around 300 to over 1,000.
- An ongoing research project is examining whether newer analysis methods are more capable or simply find different bugs than earlier methods.
- The researcher argues that human expertise remains important for designing agent workflows and recommends using AI responsibly to support hands-on security education.
Article Details
- Topics
- [00:57] Hands-on security education and vulnerability research
- [04:54] Agentic AI for vulnerability testing and false-positive reduction
- [06:45] Static analysis, fuzzing and agent-based analysis
- [09:24] Reported Linux kernel vulnerabilities and disclosure capacity
- [11:20] Comparing vulnerability analysis methods on equal terms
- [16:01] Agent workflows and vulnerability properties in kernel research
- [19:31] Human expertise and security careers in the agentic age
- [23:10] Responsible use of AI in security education