Schneier says AI may be the first technology to tilt the cyber arms race toward defenders, enabling defense at machine speed.
“It's an arms race. I think AI is the first technology that's potentially flipping that arms race to a defender advantage … Microsoft used AI to patch 900-something vulnerabilities for a Patch Tuesday last month. But they will never again be problems. You're already being attacked at computer speeds. Now you can be defending at computer speeds.”
All statements by Bruce Schneier ›
Schneier notes that he has long argued AIs could find vulnerabilities in and hack the legal system, and points to new German demonstrations.
In both a 2021 essay and my 2022 book, A Hacker’s Mind, I talk about AIs finding vulnerabilities and exploits—hacking—the legal system.
Schneier warns that lawmakers will need to harden legislation, possibly using advanced AI themselves, as AI-driven legal hacking is definitely coming.
In such a world, lawmakers would need to significantly harden the process of legislation, for example by leveraging advanced AI themselves. Still in its early stages, but definitely something that’s coming.
Schneier highlights that AI-driven vulnerability discovery is finding critical software bugs at an astonishing pace, on track to add about 26% to the all-time total this year, and calls this staggering.
3% of ‘critical’ software security bugs, in all of recorded history, have been found in the last month. This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total Do you realize how fucking insane that is?
Schneier argues AI is just a tool for campaigns, useful for both good and malicious ends, questioning why AI alone should be banned.
If you want to do good things, AI will help. If you want to do evil things, AI will help as well,
Schneier says the real significance of the aftermarket head unit story is that an ordinary person could reverse-engineer insecure IoT software with AI, and he expects many more such stories.
It’s interesting because it exposes all the insecurities in this piece of IoT software. But I think the real story is that a random person was able to do this reverse-engineering with the help of AI. Expect a lot more stories like this in the future.