AI Security Tools Are Now Cheap and Public, Changing How Hackers Find Weaknesses
Researchers have shown that powerful AI tools used to find software bugs are no longer locked away in secret labs—they're available to anyone with a credit card. This means the ability to discover critical security flaws in everything from banking apps to social media is becoming widespread, potentially changing the digital security landscape for everyone.
When a major AI company, Anthropic, revealed a powerful system called 'Claude Mythos' for finding software vulnerabilities—weak spots hackers can exploit—they treated it like a dangerous secret. They only shared it with a select group of big tech companies and government officials, warning that it was too risky for public use. The idea was that only a few, heavily vetted organizations should have such a powerful tool. But a new study from Vidoc Security turns that warning into a public reality check. They proved that similar results can be achieved using AI models anyone can access online, like GPT-5.4 and Claude Opus, for less than $30 per attempt.
How AI Finds Bugs Like a Detective
Finding a software bug is like looking for a single loose brick in a massive, constantly changing wall. Traditionally, this requires highly skilled human experts who manually examine millions of lines of code. AI changes this process. It can scan the entire 'wall' rapidly, flagging areas where the structure looks odd. The researchers didn't just ask the AI a simple question; they built a multi-step process. First, a planning AI split a large software file into smaller chunks. Then, a detection AI examined each chunk, looking for patterns that often lead to bugs. It could also check related files to see if a problem in one area affected another.
- They tested this on real, widely-used software: a file-sharing system, a secure operating system, video processing software (like what runs YouTube videos), and libraries that handle digital signatures (like the electronic 'seals' on official documents).
- In multiple runs, the public AI models successfully identified the same specific bugs that Anthropic's exclusive system had found.
- One model even independently rediscovered a known bug in a secure operating system three separate times.
The Gap Between Finding and Exploiting
The study clarifies a crucial difference: finding a weakness is not the same as building a weapon. Anthropic's private model did more than just spot the bug; it figured out how an attacker could combine different pieces of the flaw to remotely take control of a computer. The public models in this test found the hole but didn't automatically create the step-by-step attack plan. This is the current 'moat' or barrier. The cheap, widespread part is the discovery. The expensive, difficult part remains turning that discovery into a reliable, trusted fix or a deeply understood threat.
Key takeaways
- Discovery is Democratized: The initial, critical step of finding software vulnerabilities is now accessible using affordable, public AI tools.
- The Barrier Has Shifted: The advantage no longer lies solely in having the best AI model, but in the expertise to validate findings and understand their real-world impact.
- The Timeline Accelerated: While Anthropic estimated similar capabilities would spread from other labs in 6-18 months, this research shows the discovery capability is already here.
What Does This Mean for Regular People?
This doesn't mean hackers will instantly break into every system. But it means the tools to find potential weaknesses in the software that powers your online banking, social media accounts, and even government services are becoming cheaper and more common. For software companies and security teams, the pressure to find and fix bugs faster is increasing dramatically. For everyone else, it underscores the importance of using updated software and strong, unique passwords, as the digital landscape's underlying security is being probed more intensely than ever.
— Editorial Team
