LLM Agents Generate Automated Exploits from Security Vulnerability Rumors Alone… Open Source Security Process in Crisis

Through a case of a path traversal vulnerability discovered in the cohttp library of OCaml, it was demonstrated that LLM-based agents can generate exploits without detailed code or PoCs for security vulnerabilities. The author analyzed that actual attack attempts occurred within 10 minutes after the security patch PR was published, because agents can write attack code based solely on the type of vulnerability.

The Threat of LLM-Based Automated Exploits

• Accelerated Attack Speed: Previously, detailed vulnerability information was required, but now LLMs generate exploits with only hints about the vulnerability type. Research shows that GPT-4 agents exploited 7% of benchmark vulnerabilities without CVE descriptions, rising to 87% when descriptions were provided.
• Invalidation of Security Embargoes: Even when vulnerability details remain undisclosed, agents can autonomously explore codebases to find vulnerabilities and write attack code. As a result, existing security processes premised on 'maintaining secrecy' are no longer effective.

Increased Burden on Open Source Maintainers

• Bugonomics: While LLMs discover vulnerabilities in bulk and generate exploits, the speed of maintainers' verification and patch deployment cannot keep up. This causes a bottleneck in the defensive side's response capability.
• Need for a Change in Response Strategy: Simple manual triage processes cannot cope with the rapidly increasing rate of vulnerability discovery. Workflows are needed that utilize LLMs and program analysis tools to allow maintainers to verify vulnerabilities and prioritize them more efficiently.