A separate vulnerability in Linux allows users with limited rights to escalate to root. Tracked as CVE-2026-43499, it lurked in the OS for 15 years. Researchers from Nebula Security said they discovered it using Vega, Nebula’s AI-assisted vulnerability scanner. Matt Lucas, a researcher and founder of RedEye Security, explained
This will become more and more common as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.
Keep in mind that the rate of errors caught by AI will not be consistent. It will drop off over time.
While I’m no fan of AI, that has nothing to do with it. Adding AI to error detection suites is (mostly) fine so long as you don’t remove more tradional methods like code review, manually set up unit tests, and properly reviewing each failed test instead of just letting the AI slop in a patch.
My point is that any test you add to an existing codebase is going to catch a decent number of issues at first, then over time it will drop off as pre-existing issues get resolved. Then you’ll be left with the lower rate of new issues from updates.
AI isn’t a silver bullet. It (sometimes) is another tool in the toolbox.
This will become more and more common as we use AI to find vulnerabilities faster (hopefully) than bad actors can use AI to find vulnerabilities.
If you pay attention you can hear a hundred NSA assholes tear their hair out
20 years of hoarding CVEs down the drain.
Now they’ll never be able to gg ez their way into any country and will have to actually use their bribery budget to get more implants lol.
Which means the new paradigm will be ‘every piece of hardware is a supply chain attack.’
cough TPM 2 cough
You don’t think frontier AI models are leaving some out deliberately?
If they leave it out someone else will find it, the days of leaving things out deliberately past.
This is why they restrict Mythos and similar.
They want the vulnerability machine, and they don’t want you to have it.
Keep in mind that the rate of errors caught by AI will not be consistent. It will drop off over time.
While I’m no fan of AI, that has nothing to do with it. Adding AI to error detection suites is (mostly) fine so long as you don’t remove more tradional methods like code review, manually set up unit tests, and properly reviewing each failed test instead of just letting the AI slop in a patch.
My point is that any test you add to an existing codebase is going to catch a decent number of issues at first, then over time it will drop off as pre-existing issues get resolved. Then you’ll be left with the lower rate of new issues from updates.
AI isn’t a silver bullet. It (sometimes) is another tool in the toolbox.
I would fully agree with that statement.