[Edefcon 2] Anthropic Threat Intelligence report

[rcjordan]

#privacy #security #LLM

^{Grab your coffee and read this.}

Detecting and countering misuse of AI: August 2025

https://www.anthropic.com/news/detecting-countering-misuse-aug-2025


also: Don't bank online.

[ergophobe]

I wonder if any novel zero-day exploits have been found by AI

The problem described in the article affects mostly the volume of attacks. I bet there is another set of more worrisome problems that is flying more under the radar.

In theory, we should be able to have really good code scanners. For years now the Drupal project scans everything in the repo (both core and publicly contributed add-ons) using dumb algorithms (basically a big set of regex searches). The problem with getting AI to do a great job on this currently is that the context windows are too small to load a complex program in full, so it can only scan it in pieces without "understanding" the whole.

But in general, we'll need good AI security scanners for open source projects because bad actors will have good scanners for exploits... maybe the same scanners actually.

[rcjordan]

Hackers use new HexStrike-AI tool to rapidly exploit n-day flaws

https://www.bleepingcomputer.com/news/security/hackers-use-new-hexstrike-ai-tool-to-rapidly-exploit-n-day-flaws/

[ergophobe]

>> integration of AI agents to autonomously run over 150 cybersecurity tools for automated penetration testing

Thanks.

I was thinking of the next step - not where agents run existing "dumb" tools, but where self-learning systems analyze code and figure out new attacks in the way that Alpha Go came up with moves that no human had thought of yet.

[rcjordan]

You know it's already out there.  Likely state-sponsored.

[ergophobe]

>> You know

I was more circumspect - I said "I bet" but I would agree there is a very high chance it's out there now and complete certainty that if not out there now, it will be soon.

Strangely, I'm not sure the state actors have access to the giant models that can look at a big context window for this purpose. There are only a few of them out there.