AI News AI资讯 3h ago Updated 1h ago 更新于 1小时前 48

AI is finding bugs faster than humans can fix them AI发现漏洞的速度快于人类修复的速度

AI is discovering security vulnerabilities at an unprecedented pace, far outstripping the ability of organizations to triage and patch them Google used AI agents to find and fix 1,072 Chrome security bugs in 60 days; Microsoft's July 2026 Patch Tuesday shipped a record 570 patches including three zero-days The mean time to exploit has collapsed from 63 days to -7 days, meaning exploitation now occurs before patches are even released AI-generated bug reports create a massive triage burden, with m AI发现安全漏洞的速度呈指数级增长,但人类修复能力远远跟不上,形成"发现-修复"的巨大鸿沟 即使苹果、微软等科技巨头也面临漏洞报告过载,苹果已限制研究人员提交漏洞的数量 AI自动修复漏洞效果有限,研究显示AI引入的新漏洞是开发者的近9倍,补丁成功率仅约80% 漏洞利用时间从平均63天缩短至-7天(补丁发布前即被利用),安全窗口期几乎消失 安全团队面临"分类税":大量AI生成的报告包含噪音和误报,消耗专家注意力进行验证

72
Hot 热度
65
Quality 质量
70
Impact 影响力

Analysis 深度分析

TL;DR

  • AI is discovering security vulnerabilities at an unprecedented pace, far outstripping the ability of organizations to triage and patch them
  • Google used AI agents to find and fix 1,072 Chrome security bugs in 60 days; Microsoft's July 2026 Patch Tuesday shipped a record 570 patches including three zero-days
  • The mean time to exploit has collapsed from 63 days to -7 days, meaning exploitation now occurs before patches are even released
  • AI-generated bug reports create a massive triage burden, with many being false positives or low-value findings that still require expert human review
  • LLMs introduce nearly 9x more new vulnerabilities than human developers when attempting fixes, and even the best AI patching tools achieve only ~80% success rates

Why It Matters

This article highlights a fundamental shift in the economics of vulnerability management: AI has made finding bugs cheap and abundant, but fixing them remains expensive and error-prone. For AI practitioners and security professionals, this represents an urgent operational crisis that will only intensify as AI discovery tools continue to improve.

Technical Details

  • Google's AI agents identified and remediated 1,072 Chrome security bugs in just 60 days, demonstrating the scale of AI-assisted vulnerability discovery
  • AI-linked three separate vulnerabilities to create the HermeticReader attack on Adobe's Acrobat Chrome extension, enabling unauthenticated zero-click data exfiltration from WhatsApp Web via the DeepSeek LLM and Hermes Agent framework
  • An academic study of 20,000+ AI-fixed issues found LLMs introduce nearly 9x more new vulnerabilities than human developers, with unique vulnerability patterns
  • PatchitPy and similar AI patching tools achieve only ~80% successful repair rates, and multiple rounds of AI fixes can actually increase critical vulnerabilities
  • Linux kernel saw 432 CVEs reported in just two days in July 2026, while Microsoft's Patch Tuesday routinely ships hundreds of patches including zero-days

Industry Insight

  • Organizations must invest aggressively in automated triage, deduplication, and scoring pipelines before human reviewers ever see vulnerability reports, or they will drown in noise
  • Security teams should adopt narrower AI scopes for remediation (e.g., "update this dependency" rather than "fix this vulnerability") and separate patch verification from patch generation as a best practice
  • The staffing gap in cybersecurity is now primarily a budget and leadership problem, not a talent shortage; companies that fail to fund adequate security teams will face catastrophic exposure as AI accelerates both vulnerability discovery and exploitation

TL;DR

  • AI发现安全漏洞的速度呈指数级增长,但人类修复能力远远跟不上,形成"发现-修复"的巨大鸿沟
  • 即使苹果、微软等科技巨头也面临漏洞报告过载,苹果已限制研究人员提交漏洞的数量
  • AI自动修复漏洞效果有限,研究显示AI引入的新漏洞是开发者的近9倍,补丁成功率仅约80%
  • 漏洞利用时间从平均63天缩短至-7天(补丁发布前即被利用),安全窗口期几乎消失
  • 安全团队面临"分类税":大量AI生成的报告包含噪音和误报,消耗专家注意力进行验证

为什么值得看

这篇文章揭示了AI时代网络安全领域的根本性矛盾:检测能力与修复能力的严重失衡,这一趋势正在重塑整个软件供应链的安全生态。对企业而言,这不仅是技术挑战,更是运营模式和资源分配的战略危机。

技术解析

  • Google AI代理漏洞发现:Google使用AI代理在60天内发现并修复了1,072个Chrome安全漏洞,展示了AI在漏洞发现方面的高效能力,但这也意味着需要同等规模的修复资源。
  • AI修复漏洞的局限性:学术研究分析20,000+个由AI修复的问题发现,LLM引入的新漏洞数量是开发者的近9倍,且许多漏洞呈现开发者代码中不存在的新模式。PatchitPy等AI补丁工具的成功率仅约80%,多次AI修复后关键漏洞数量甚至可能上升。
  • 漏洞报告规模激增:Linux内核在2026年7月两天内报告432个CVE;微软2026年7月Patch Tuesday发布570个补丁(含3个零日漏洞)创历史记录;Adobe Acrobat扩展漏洞被AI关联三个不同漏洞利用,并通过DeepSeek LLM + Hermes Agent框架自动化攻击。
  • 漏洞利用时间急剧缩短:Linux Foundation CEO指出,利用漏洞的平均时间已从63天缩短至-7天,即攻击者在补丁发布前就开始利用漏洞,安全团队失去响应窗口。
  • AI漏洞报告验证成本:安全团队需要投入专家时间验证AI生成的报告,区分重复项、幻觉或真正漏洞,这种"分类税"在小团队中影响尤为严重。

行业启示

  • 安全运营模式需要根本性重构:企业必须建立更激进的漏洞分类规则、自动化去重和评分机制,在报告到达人类之前进行预处理,否则安全团队将被淹没在AI生成的噪音中。
  • 漏洞修复策略应从"全面修复"转向"风险优先":鉴于AI修复可能引入新漏洞,企业应采用Google的建议:缩小AI修改范围、分离修复与验证阶段、对复杂变更保留人工审核,而非盲目依赖AI自动修复。
  • 安全投入不足将成为系统性风险:ISC2调查显示预算约束已成为人员短缺的首要原因,而非人才匮乏。在AI加速漏洞发现和利用的背景下,企业若不增加安全团队配置和预算,将面临比Morris蠕虫或Marks & Spencer勒索软件攻击更严重的后果。

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全 LLM 大模型 Research 科学研究