Anthropic, the creator of Claude, has released a guide warning that AI advancements will empower cyber attackers to identify and exploit software vulnerabilities at a rapid pace. In the next two years, AI models are expected to uncover numerous long-standing bugs in code and convert them into functional exploits. This development poses a significant challenge for organizations, necessitating immediate action to bolster their security measures.
According to Anthropic, AI models already possess the capability to detect critical vulnerabilities that traditional security reviews may overlook. However, defenders can leverage AI technology to enhance their response strategies. Anthropic has outlined a series of recommendations based on its own security initiatives.
To begin with, organizations are urged to promptly address their patching deficiencies. AI can efficiently reverse-engineer patches into exploitable vulnerabilities, reducing the timeframe between patch release and exploit availability. Vulnerabilities listed in the CISA Known Exploited Vulnerabilities catalog should be treated as urgent, with internet-facing systems requiring patching within 24 hours.
Security teams should also anticipate a surge in vulnerability disclosures, possibly increasing tenfold. Automation complemented by human oversight will be crucial for efficient vulnerability assessment and prioritization.
Moreover, companies are advised to detect bugs before deploying code by incorporating static analysis and AI-assisted code review into their continuous integration workflows. Embracing secure-by-design principles, opting for memory-safe languages in new code development, and scrutinizing internet-facing services and legacy code are vital steps.
Organizations are further encouraged to proactively scan their codebases using models akin to those employed by attackers, with a focus on internet-facing services and legacy systems that may have received inadequate scrutiny.
Implementing a zero-trust architecture is deemed essential, requiring access to be linked to verified hardware, replacing long-lived secrets with short-lived tokens, and isolating services based on identity rather than relying solely on network segmentation.
Maintaining an inventory of internet-facing hosts and services, decommissioning redundant systems, and minimizing service exposure are additional measures recommended by Anthropic. Incident response times should also be expedited by integrating models into the alert queue, automating incident documentation, and conducting tabletop exercises for multiple incidents simultaneously.
For smaller teams lacking dedicated security personnel, Anthropic suggests enabling automatic updates, utilizing managed services, employing passkeys or hardware security keys, and activating free security tools on code hosting platforms.