Fullscreen HTML5Med Res (??MB)HTML4

SILICON SILIC CHIP www.siliconchip.com.au Publisher/Editor Nicholas Vinen Technical Editor John Clarke – B.E.(Elec.) Technical Staff Bao Smith – B.Sc. Tim Blythman – B.E., B.Sc. Advertising Enquiries (02) 9939 3295 adverts<at>siliconchip.com.au Regular Contributors Allan Linton-Smith Dave Thompson David Maddison – B.App.Sc. (Hons 1), PhD, Grad.Dip.Entr.Innov. Geoff Graham Associate Professor Graham Parslow Dr Hugo Holden – B.H.B, MB.ChB., FRANZCO Ian Batty – M.Ed. Phil Prosser – B.Sc., B.E.(Elec.) Cartoonist Louis Decrevel loueee.com Founding Editor (retired) Leo Simpson – B.Bus., FAICD Silicon Chip is published 12 times a year by Silicon Chip Publications Pty Ltd. ACN 626 922 870. ABN 20 880 526 923. All material is copyright ©. No part of this publication may be reproduced without the written consent of the publisher. Subscription rates (Australia only) 6 issues (6 months): $77.50 12 issues (1 year): $145 24 issues (2 years): $270 Online subscription (Worldwide) 6 issues (6 months): $55 12 issues (1 year): $105 24 issues (2 years): $200 For overseas rates, see our website or email silicon<at>siliconchip.com.au * recommended & maximum price only Postal address: PO Box 194, Matraville, NSW 2036. Phone: (02) 9939 3295. ISSN: 1030-2662 Printing and Distribution: 1 Huntingwood Dr, Huntingwood NSW 2148 54 Park St, Sydney NSW 2000 2 Silicon Chip Editorial Viewpoint AI is reshaping computer security Love or hate AI, as I predicted in May 2023, it is having a significant impact on the world. I will admit that I didn’t mention computer security as an area where the impact would be disproportionate, but that seems to be the case. AI systems are becoming remarkably good at reviewing source code, analysing program behaviour and looking for mistakes that human programmers and security researchers have overlooked. That is potentially a very good thing. Modern software is extraordinarily complicated. An operating system such as Windows or Linux contains tens of millions of lines of code and has accumulated contributions over decades. No human being could possibly read and understand all of it, while conventional automated tools are generally limited to looking for particular classes of errors. AI changes that equation because it can examine huge quantities of code and reason about the way different pieces interact. It can also generate test cases, investigate suspicious behaviour and increasingly determine whether an apparent bug is actually exploitable. This is no longer hypothetical. Microsoft’s new MDASH security system found 16 vulnerabilities that were fixed in its May 2026 Windows updates. Four of those were rated critical and could allow remote code execution. Google’s Big Sleep AI system has similarly discovered vulnerabilities in widely used software, including an exploitable memory-safety bug in SQLite. The scale is becoming enormous. VulnCheck found that CVE (Common Vulnerabilities and Exposures) disclosures were sharply higher across numerous major software suppliers during 2026, including Chrome, Mozilla, Apache, VMware and others. Finding bugs is becoming so easy that they’re being found quicker than they can be fixed. Anthropic’s Project Glasswing (started in April this year) picked up more than 23,000 potential bugs; only a fraction had been reported to software maintainers by June. Someone has to determine whether each bug report is genuine, work out which versions are affected, develop and test a fix and distribute it without introducing another problem. Software maintainers are becoming inundated. Open-source developers have already complained about large numbers of AI-generated security reports. Some are nonsense; false reports waste resources, too. In May, Google’s Threat Intelligence Group reported what it believes was the first observed case of a threat actor using a zero-day exploit developed with the assistance of AI. Anthropic reported last year that a state-sponsored espionage group had manipulated Claude Code into helping attack roughly 30 organisations. A small number of the attacks succeeded. In a sense, we have entered a new race between the ‘white hats’ finding and fixing vulnerabilities and the ‘black hats’ finding and exploiting them. Still, of the 1061 vulnerabilities that VulnCheck identified as having been discovered with AI assistance in the first half of this year, only 14 had been confirmed as exploited in the wild. So AI has unquestionably caused an explosion in finding vulnerabilities, but there is not yet evidence of a corresponding explosion in successful attacks. In the longer term, we should end up with more secure software. In the short term, though, we have a vast stockpile of existing software being examined simultaneously by increasingly capable machines on both sides. While AI won’t inevitably make computer security worse, it has dramatically increased the speed at which both sides can operate. It reminds me of the saying usually described as an ancient Chinese curse: “May you live in interesting times”. We certainly do. Cover background image: https://unsplash.com/photos/green-and-red-light-digital-wallpaper-bEd5KVP5b4g Australia's electronics magazine by Nicholas Vinen siliconchip.com.au