AI Can Chain Some Vulnerabilities but Still Struggles With Others

Summary

A speaker says AI can help chain vulnerabilities, but its success varies by vulnerability class. They describe business logic flaws, IDORs, remote code execution, and XXEs as areas where AI can struggle without the right harness.

Key points

• The speaker says AI’s ability to connect vulnerabilities into chains was more capable than expected.
• They describe vulnerability chaining as a task that previously required a skilled researcher.
• AI may find some vulnerability chains more easily than others.
• The speaker says AI struggles with business logic flaws, IDORs, remote code execution, and XXEs.
• Building the right harness is described as important for getting AI to perform effectively.