Security through obscurity is dead, and AI delivered the fatal blow
AI agents are killing security through obscurity, accelerating vulnerability discovery and patch-gap exploitation, experts warn, with OT/ICS systems most at risk.
An opinion/analysis piece arguing AI has made security through obscurity obsolete, citing record vulnerability disclosure volumes after Microsoft's Patch Tuesday addressed 974 CVEs. FBI Cyber Division assistant director Brett Leatherman said latest AI models found significant vulnerabilities in open source libraries running on most web servers. The article cites at least four espionage crews (most suspected China-linked) exploiting Chromium's patch-gap window with a rapid exploit kit, and a five-agency advisory on AI-generated exploitation scripts breaching internet-exposed Siemens S7 Series PLCs at water, manufacturing, and energy facilities. Experts including John Hultquist, Chris Inglis, and Katie Moussouris warn AI erodes the expertise barrier protecting obscure OT/ICS systems while defensive AI patching lags, with studies showing AI-generated patches fail more than half the time.
- AI bug-hunting agents drive record CVE disclosures and a massive patch backlog for maintainers
- At least four espionage crews, mostly China-suspected, exploited Chromium's patch-gap with an exploit kit
- Five US agencies reported AI-generated exploit scripts breaching internet-exposed Siemens S7 PLCs
- Experts warn OT/ICS security depended on scarce expertise that AI now commoditizes for attackers
- Studies find AI-generated patches fail more than half the time, leaving defense behind
From the original article
6 min read at theregister.comThe term "security through obscurity" describes an old idea that networks and systems will remain secure so long as their architecture, along with any vulnerabilities or other weaknesses, remains secret or hidden. It was never a sound strategy for protecting sensitive assets and systems, but many organizations leaned on it due to lack of resources or complacency.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.