/Tech25d ago

ExploitGym Study Shows AI Models Uncover Distinct Exploitable Vulnerabilities

27516259.8K
zooko🛡🦓🦓🦓 ⓩ
Brendan Dolan-Gavitt#1386
Original postBrendan Dolan-Gavitt#1386
zooko🛡🦓🦓🦓 ⓩ@zooko

This is important. The authors of the paper (I read it) appear to have missed the most important conclusion: the large number of vulns exploited by some AIs but not others means there are a lot more exploitable vulns out there! ⤵️

Aaron Grattafiori@dyn___

This is an extremely interesting, and important graph for where we are related to Offensive Security related tasks in AI. From the ExploitGym paper. https://arxiv.org/pdf/2605.11086

7:49 AM · May 17, 2026 · 9.8K Views
Sentiment

Users recommend testing Fil-C right away because it blocks compilation of code with memory safety flaws, providing concrete protection against AI-augmented exploits.

Pos
100.0%
Neg
0.0%
3 comments with sentiment.
Cluster Engagement
Posts from X
Most Activity
Most Activity
VIEWS392
zooko🛡🦓🦓🦓 ⓩ@zooko

It probably already does! But you still have to benchmark it, support it, and tell your users to use it. If not, it is probably a 10-minute job to make it work with Fil-C. And unlike standard hardening, Fil-C can actually protect users from these AI-augmented exploits. 🔚

25dViews 392Likes 1
LIKES4RETWEETS1
zooko🛡🦓🦓🦓 ⓩ@zooko

This means we are still at the beginning of the wave of AI-augmented exploitation of 0-days/n-days. It's going to get worse before it gets better. ⤵️

25dViews 225Likes 4
REPLIES2
zooko🛡🦓🦓🦓 ⓩ@zooko

I would like to urge all software maintainers to try another actionable step, right now: go test if your software works with Fil-C! https://fil-c.org/ ⤵️

25dViews 174Likes 1
zooko🛡🦓🦓🦓 ⓩ@zooko

(For the context on why I say that high degree of non-overlap implies the existence of a lot more exploitable vulns, read Dan Geer's simple explanation of how you count frogs in a pond: https://x.com/dinodaizovi/status/2043317679017124181) ⤵️

25dViews 104Likes 2
zooko🛡🦓🦓🦓 ⓩ@zooko

The paper examines the actionable step of "Turn on ASLR and suchlike standard hardenings". It helps! Go do this now. But it does not help enough to protect users at scale during this wave. ⤵️

25dViews 21Likes 1
Jacob Gadikian@Senpai_Gideon

@zooko Hey this is ridiculously good! Basically, fil-c won't compile if there are memory safety issues?

Is it a more or less foolproof test for memory safety problems?

Neat!

25dViews 21