[CVE AI Virtual Conference] Waiting for the Fever to Break: Discovery, Triage, and Vulnerability Disclosure in an Agentic World

[erickgalinkin]

Sorry for submitting so late! Feel free to blow me off, love you.

Abstract

Widespread press about the use of agents for security has led to a deluge of vulnerability reports. These reports can be just as good as human-authored reports -- that is, some are great and others are of extremely dubious quality. The sheer volume of these reports begets a further problem: triaging vulnerability reports takes time and effort, especially when such reports lack fully-functional exploit code. In this talk, we discuss how LLM-powered agents do vulnerability discovery, how LLMs can help with triage, and the pitfalls of each. We propose a way forward for both researchers and CNAs to ensure responsible disclosure.

[boblord]

Sounds like you have ideas for how vulnerability finders can improve the quality of their submissions to make them more likely to be actioned, and also ideas for how software manufacturers (commercial and open source) can help assess and address the higher volume of reports.

Question: Would you be able to present direct experiences from your job? Even experiments that had mixed results would be useful for vulnerability finders and PSIRT team members.

[erickgalinkin]

Absolutely. My plan is to use some lightly obfuscated or "inspired by true events" examples as anecdata.