The frontier AI threat isn't from finding new vulnerabilities, it's exploiting old ones

Much has been written about the threat of new “frontier” AI models like Mythos and Fable, as well as emerging ones from Chinese companies such as Moonshot, Alibaba, and Deepseek.  Most scary projections (at least the ones that don’t talk about autonomous killer robots) focus on AI’s improving ability to find previously undiscovered vulnerabilities.  While that’s a concern, it isn’t the risk I worry about.

Why?  Because AI models are already pretty good at finding vulnerabilities.  There may be some risks lying dormant, but odds are they would be found with or without the new models.  Additionally, we’ve learned over time to quickly patch “zero day” vulnerabilities when we need to.  Net, the volume of these new risks is likely to be low and our ability to respond is good (I won’t say great, because it varies widely from company to company…some still have unpatched log4j vulnerabilities).

The risk I worry about lives in the vast sea of vulnerabilities that we already know about, when combined with improved reasoning in these new models.

Most patching programs apply risk scores to each known vulnerability.  Standard scoring frameworks like CVSS adjust the base score depending on local environment factors like compensating controls, or the sensitivity of data on a vulnerable system (ignoring these factors makes the scores much less useful).  The risk scores then get mapped onto a scale ranging from Critical to Low.  And most companies have policies that encourage rapid patching of anything deemed Critical or High.  Similar programs exist for identified code weaknesses even without a demonstrated vulnerability.

That covers Criticals and Highs. Risks classified as Medium get patched at a much slower rate, and Lows are left to accumulate for a long time.  The result is that many large companies (and some not so large ones) have huge backlogs of unpatched Lows and Mediums…often tens or hundreds of thousands of instances.  The issue is a couple of Lows and Medium risks can sometimes combine to create a High risk.  It’s a little harder to do, but adversaries who are denied easy access to High or Critical exploits often try to “chain” multiple vulnerabilities.  Fortunately we have frameworks to highlight those combinations, notably MITRE’s ATT&CK, which identifies kill chains that must be broken by patching at least one vulnerability.

So, we have huge backlogs of things that are deemed lower risk, and most haven’t warranted urgent attention.  The handful that do can be identified and managed.  The rest would take a herculean effort to address quickly, with significant impact to operations and the business.

Now comes the problem. New frontier models like Fable are better than their predecessors at chaining together complex tasks to achieve a goal. Human attackers might only be able to juggle a handful of vulnerabilities in a chain.  After that it starts getting too complex to identify a sequence of steps that can be combined to execute a specific attack.  New LLM models, however, are able to chain dozens of vulnerabilities, even hundreds.  While long kill chains are easier to break, a huge volume of what we assumed to be low risk vulnerabilities are now in scope for rapid patching.  And the number of new, complex, kill chains that can be built by AI is likely a nonlinear function of the number of unpatched vulnerabilities.

The accidental breach of Hugging Face by an escaped OpenAI agent is a perfect example.  The agent chained a zero-day vulnerability in a package cache with privilege escalation vulnerabilities to move laterally and exit OpenAI.  Once on the Internet, it reportedly used leaked or stolen credentials with at least two different RCE (Remote Code Execution) vulnerabilities to access the data inside of Hugging Face.  This isn’t an obvious combination that might have been run by script kiddies; it was both complex and custom.  Unless every vulnerability is patched, the new models will find a way to use them.

What does this mean in practice?  Those many thousands of Low (and Medium) vulnerabilities might need to get patched, quickly.  Their aggregate use across multiple chains becomes a larger risk.  Said differently, Low risk in isolation no longer means Low risk in combination.  And we don’t know all of the combinations.

The only real solution is to patch everything by automating patching and software updates so every vulnerability is immediately addressed.  That’s less of a technical problem than a business one.  It’s not that we couldn’t patch vulnerabilities until now, it’s that we wouldn’t patch them.  We wouldn’t patch them because we assumed that every patch needs extensive testing to ensure that nothing breaks.  And that testing doesn’t scale to the volumes we need to patch.

What can we do?  First, we need to change our assumption about patching.  The vast majority of fixes are backward compatible, meaning applying them won’t break anything.  Our default should be to just apply low risk patches with either a quick/automated regression test or a rapid rollback plan (or both).  Policies shouldn’t refer to vulnerability risks in isolation; they should be updated to say “absent a SPECIFIC reason to NOT apply a patch, all vulnerabilities must be patched immediately.” And we can leverage AI to help us fight the new AI created risks. Not only can AI agents patch, test, deploy, and rollback code, they can assess the risk of applying each patch in advance.  By looking at both the code and the new patch or change, they can quickly determine the risk of applying it.  “High risk” becomes about high risk patches, not about high risk vulnerabilities.  And high risk patches are the only ones that need extensive testing and attention.

Using AI to assess patching risk, combined with an “immediately patch” approach, will remove the vast majority of available fuel for frontier models to exploit.  If we don’t, we may find ourselves getting burned by things we used to defer.