PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Machine Learning for Vulnerability Discovery

xbow.com | research | #ai-security | #appsec | #vulnerability-discovery | #false-positives | #machine-learning | #validation
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Machine learning accelerates vulnerability discovery but over-reports false positives without runtime context; the article argues for pairing ML detection with AI-driven exploitability validation.
Published
Collected

Related coverage

research · xbow.com
Why LLMs Hallucinate Vulnerabilities
Explains why LLMs produce confident but false vulnerability findings (plausibility is not proof) and why results must be validated against real system behavior.
research · theori.io
The Frontier Isn’t the Model: Why ‘Good Enough’ Reasoning + Scaffolding Is More Important
Xint researchers argue vulnerability discovery owes less to frontier models than to scaffolding, comparing Mythos’s disclosed results with broadly available models and how to pick a model per task.
research · portswigger.net
Beware the false false-positive: how to distinguish HTTP pipelining from request smuggling
Kettle explains how to distinguish HTTP pipelining false positives from real request smuggling, covering connection-locked smuggling, connection state attacks and client-side desync.
research · theori.io
Inside the brain of a hacking robot: Exploring traces | AI Cyber Challenge
Walkthroughs of agent trajectories from Theori’s autonomous hacking system: how LLM agents found bugs in SQLite, FreeRDP, Nginx and more during AIxCC practice runs, and what the logs reveal.
research · depthfirst.com
Introducing dfs-large1: A New Frontier for Cybersecurity
The release describes a concrete training and evaluation recipe for long-horizon AI code auditing, including repository-scale context, executable validation and explicit pressure against speculative findings.
research · depthfirst.com
21 Zero-Days in FFmpeg
depthfirst's autonomous agent discovered 21 zero-day vulnerabilities in FFmpeg and produced reproducible PoC inputs at a fraction of typical cost; several bugs had lain latent for 15-20 years.
Back