Japan to implement artificial intelligence for network vulnerability detection and countering hackers

With the development of artificial intelligence (AI), devices connected to the internet and exchanging data in the so-called 'Internet of Things' (IoT) can become a source of problems. According to a report by Anthropic published in October, AI-based malware can be installed on such devices and spread autonomously.

Computer viruses that move independently from one machine to another are known as 'worms'. They follow a predefined plan, utilizing known security vulnerabilities or poorly protected access points. Typically, solving this issue involves fixing bugs and closing gaps in the security system. However, in the case of AI-based 'worms', the situation becomes significantly more complex and dangerous.

This is because this more advanced type of 'worm' is capable of independently solving problems and adapting to different types of devices. Researchers at Anthropic, the developer of Claude, demonstrated that AI applications can function without the need for a large data center.

In a controlled test environment, researchers created simulations of eight Android devices. The tested AI model was installed on one of these devices, then copied from it and infected the others. In four out of five attempts, the model reached all eight targets, and in one, it infected seven.

If such an AI model were combined with malicious software, the 'worm' could learn to bypass security measures. According to Anthropic developers, this would take approximately one to two days. Furthermore, the AI could potentially connect infected devices into a botnet.

Although an infected device has limited computational capabilities, the more devices that are infected, the faster the 'worm' can spread. Connected devices can theoretically be disconnected from the network, and security vulnerabilities can be patched. Nevertheless, the decentralized structure of such malware will greatly complicate its localization.

Anthropic describes this type of infection as 'digital slime mold,' which grows slowly. The company believes that smaller AI models will be able to achieve this level of propagation capability as early as 2026.

Artificial intelligence is accelerating the process of discovering software vulnerabilities, reducing the time allocated for their remediation. Cybersecurity experts polled by Reuters predict new disruptions in digital services as companies and governments attempt to prepare for the exploitation of these flaws.

A study conducted by VulnCheck, scheduled for publication in the coming days, shows that the number of discovered digital vulnerabilities has doubled compared to the previous year. Issues registered this week on European government websites demonstrate the pressure such discoveries can cause.

Disruptions began on Wednesday after vulnerabilities were found in PHP, a programming language used in many parts of the internet. To prevent attacks, operators rushed to fix their systems. Some temporarily took sites offline because they could not apply updates before potential intrusions.

This race for fixes occurred during a week already marked by other security issues. Vulnerabilities were disclosed in Node.js and Plex, as well as incidents related to the AI platform LiteLLM and the development platform Railway. The Indian certification authority eMudhra also drew attention due to the use of an extremely weak cryptographic key, which could have jeopardized internet users.

Matthew Prince, CEO of Cloudflare, told Reuters that he is aware of other serious vulnerabilities in software critical to network operation. In his assessment, the sector will face difficult months ahead. He noted: 'I think we will have several years where it feels like the sky is falling every week.'

Previously, searching for vulnerabilities in complex programs required specialized knowledge. Developing tools to exploit them could take weeks or months, giving system administrators time to prepare fixes and distribute updates. However, artificial intelligence is shortening this timeframe. Models are capable of continuously analyzing large codebases, finding issues, and helping develop exploitation tools in just a few hours.

Shane Fry, CTO of RunSafe Security, emphasized the change in the pace of this process. He stated: 'What is fundamentally and undeniably changing is the time required both to discover vulnerabilities and for adversaries to be able to exploit them.'

In light of this situation, security teams must handle tasks that go beyond simply identifying code errors. Specialists are concerned about the reduced response time, but there is no consensus on whether accelerated vulnerability discovery will lead to a wave of successful attacks.

Daniel Steinberg, lead developer of the curl file transfer tool, notes that some vulnerabilities found by AI models are complex and difficult to exploit. Rami Rahman from security company ArmorCode also points out that publishing more vulnerabilities does not necessarily mean an increase in successful attacks. The PHP case serves as an example of this difference: threat intelligence firm Hunt.io discovered aggressive exploitation attempts but reported that by 2 PM Eastern Time on Thursday, the tracked attackers had apparently not yet managed to develop a functional tool to use this vulnerability.

Prince mentioned signs of intrusion related to the vulnerability. Nevertheless, he believes that accelerated problem discovery can bring long-term benefits by allowing the fixing of errors that have remained hidden for years.