Teaching AI to Find Real Vulnerabilities — David Brumley, Bugcrowd
David Brumley demonstrates how to train AI models to find security vulnerabilities in code through a stepwise method—from crashing a program to reading and writing memory to full attacks.
The major challenge is measurement: since many possible vulnerabilities exist, a model can always claim to have found one, so standard tests fail. Brumley built actual training pipelines with sandboxes and objective evaluators that verify whether exploits actually work. He demonstrated this on V8 (Chrome's JavaScript engine) against 41 real vulnerabilities where the best models achieved around 95 percent success, including one previously unknown vulnerability.
Vibekollen prepared this summary with AI from the original publication. The content belongs to AI Engineer.
More to read
Lumaril, which develops AI software for optimizing industrial production by connecting to existing control systems, raised a $66M Series A at a $400M valuation
Techmeme 3 h ago
DeepSeek open sources Super-Agent as a research prototype, a proactive coding agent it says can monitor group chats for coding issues and suggest solutions
Techmeme 4 h ago
Insurance software maker Guidewire agrees to acquire Hyperexponential, which makes AI-powered insurance underwriting and pricing software, for $1.7B in cash
Techmeme 4 h ago
One word for AI agents in 2027
Nate Herk 8 h ago