AI Can Extend Cybersecurity Researchers’ Reach, but Skills Still Matter
· 28:25 · Watch on YouTube ↗
Summary
Penetration tester Fabian Faessler argues that AI can extend researchers’ capabilities but not replace expertise built through practice. He illustrates the point with mixed results from his AI-assisted browser vulnerability research.
Key points
- Faessler describes self-efficacy as continuing to make progress on difficult tasks, even without confidence that they can be solved.
- He argues that CTF challenges, including unsuccessful attempts and detours, help build technical knowledge and context.
- He says AI can extend researchers’ reach, and cites reported Firefox vulnerability findings that he attributes to skilled engineers directing AI with their knowledge of Firefox.
- Faessler describes using AI to build a V8 exploit, but says he later failed to identify a browser sandbox escape or a V8 zero-day.
- His attempt to develop a working proof of concept for a vulnerability in an outdated lib SVG dependency used by Next.js failed; he says he believed an advisory was later published.
- He advises cybersecurity practitioners to keep learning and understanding technical details rather than relying only on AI.
Article Details
- Topics
- [02:49] Learning from losses and frustration in cybersecurity competitions
- [06:34] Self-efficacy and persistence through difficult challenges
- [09:10] AI concerns and a model of cumulative learning
- [13:56] AI as an extension of researcher reach, with browser vulnerability research examples
- [21:49] Building technical context while using AI as a learning aid
- [24:46] The value of programming knowledge and continued learning as AI changes work
People
Products
Google Chrome[15:41] V8 is the JavaScript engine from Google Chrome.Mozilla Firefox[19:29] You all saw earlier this year the news about mythos, where Firefox fixed likeMythos[19:29] You all saw earlier this year the news about mythos, where Firefox fixed likeV8[15:38] and that is about a V8 and a exploit. So we.