How AI and Large Language Models Are Being Used in Cybersecurity
Summary
Semgrep security researcher Clint Gibler discusses AI applications in cybersecurity, from phishing and web security to malicious-package analysis, threat modeling, cloud security, and fuzzing, while stressing that AI is an imperfect tool.
Key points
- Gibler says AI can make some security work faster and easier but is not a universal solution and may require human review.
- AI agents could tailor phishing messages using information gathered from social media and continue interacting with recipients.
- LLM-enabled web security tools can analyze HTTP traffic; proposed extensions include reviewing request sequences and adjusting parameters.
- LLMs could help assess new software packages for malware risk using code analysis and package metadata, with people triaging results.
- Threat-modeling tools can generate threat models, attack trees, and mitigating controls from application descriptions.
- The article describes EscalateGPT querying AWS IAM policies to identify potential privilege-escalation scenarios.
- LLMs could generate fuzzing test harnesses to exercise code areas with limited coverage.
Article Details
- Topic
- Applications and limitations of AI and large language models in cybersecurity
People
Vendors
Anthropica surprisingly smart model! Some primary players in the LLM space are OpenAI, ChatGPT, Google’s Bard, Anthropic’s Claude, and Hugging Face (an AI community collaboration platform).GoogleThe result is a surprisingly smart model! Some primary players in the LLM space are OpenAI, ChatGPT, Google’s Bard, Anthropic’s Claude, and Hugging Face (an AI community collaboration platform).Hugging FaceSome primary players in the LLM space are OpenAI, ChatGPT, Google’s Bard, Anthropic’s Claude, and Hugging Face (an AI community collaboration platform).OpenAIand training time. The result is a surprisingly smart model! Some primary players in the LLM space are OpenAI, ChatGPT, Google’s Bard, Anthropic’s Claude, and Hugging Face (an AI community collaboration platform).SemgrepAs part of our CloudSec 360 series, Wiz spoke with Clint Gibler, Head of Security Research at Semgrep (and the founder of the tldrsec.com newsletter). Clint joined us to discuss several use cases for AI in the
Products
AWSIn the cloud security space, a tool called EscalateGPT queries the AWS API, returns a bunch of IAM policies, passes them to open AI, and asks it to look for privilege escalation. In testing against real-world AWSBardresult is a surprisingly smart model! Some primary players in the LLM space are OpenAI, ChatGPT, Google’s Bard, Anthropic’s Claude, and Hugging Face (an AI community collaboration platform).Burp SuiteMoving on to web security: Clint has noticed a couple of Burp Suite extensions that leverage LLMs to analyze HTTP requests and responses and search for potential security issues within them. Spokespeople from TenableChatGPTChatGPT is just the beginning. New AI tools are launching often, and new tools bring new functionality. With the long history of machine learning being used as part of cybersecurity, how are recent developments in AIClaudesmart model! Some primary players in the LLM space are OpenAI, ChatGPT, Google’s Bard, Anthropic’s Claude, and Hugging Face (an AI community collaboration platform).EscalateGPTIn the cloud security space, a tool called EscalateGPT queries the AWS API, returns a bunch of IAM policies, passes them to open AI, and asks it to look for privilege escalation. In testing against real-world AWSStride GPTtool like Stirde GPT, you provide a description of your app and specify what kind of data it processes. Stride GPT then spits out a threat model, an attack tree, and/or some mitigating controls. Because threat modeling
Tools
EscalateGPTIn the cloud security space, a tool called EscalateGPT queries the AWS API, returns a bunch of IAM policies, passes them to open AI, and asks it to look for privilege escalation. In testing against real-world AWSStride GPTtool like Stirde GPT, you provide a description of your app and specify what kind of data it processes. Stride GPT then spits out a threat model, an attack tree, and/or some mitigating controls. Because threat modeling