AI finds software flaws by tirelessly trying different ways to pick digital locks
The same tireless guessing that uncovers holes in the internet's oldest plumbing also lets attackers break in faster.
Up First from NPR · Websites Go Offline, Protests in France, Netflix DownsizesAI is uncovering so many software flaws because the tools keep trying, says Kevin Roose, co-host of a podcast about AI. They find weak spots by staying persistent and testing different ways to pick digital locks until one opens.
A recent example came from PHP, decades-old software that runs about 70% of websites. Roose said the flaws "would let someone take over any computer" that was "running a website without a password and without leaving" any fingerprints. Roose compares it to learning how to force a lock used on most doors worldwide.
The tools write software well, which also makes them strong at spotting errors and weak points. They work through many possible approaches in succession until they find an opening.
That approach is turning up problems in central infrastructure that people have used for decades, including bank systems, Node.js, and Plex, with researchers uncovering an unusually high count of defects in just the last few months.
The same capability speeds up attacks. Once a hole is public, AI tools can exploit it quickly, so defenders are racing to install fixes on affected systems first. Roose calls the contest a cat and mouse game between people patching systems and people breaking in.
Over the long term, he says, the hunt for flaws could leave systems more secure once the bugs are fixed.
Questions people ask
What does it mean to patch a system, and what should I do?
A patch is a small update that closes a known hole. For most people it means installing software updates on phones, laptops, and routers when they appear, and restarting when asked, so the fix actually takes effect.
Why is decades-old software like PHP still running most of the web?
Because it works, it is free to use, and millions of sites were built with it years ago. Replacing that foundation is expensive and risky, so website owners keep maintaining it rather than starting over.
Can AI also fix the flaws it finds?
Yes, and researchers already use AI to suggest fixes and to scan code before it is released. The problem is that the same assistant that can write a secure fix can be asked to find a way around it.