LLMs and Zero-Days

"Exploiting zero-days" is the newest addition to the ChatGPT suite of features...

“Zero-day” is a bit of a boogieman for the cybersecurity ecosphere. Not only are they the manifestation of that necessarily unknowable weakness that lies in an existing system, but they are hot commodities that the darker sides of the internet deal with (for surprisingly low costs, in some cases). When confronted with an actively exploited zero-day, the average cybersecurity professional might start to think about changing career paths or contemplating how easy it would be to implement a fully air-gapped on-prem system in order to put a cork in the ever-leaking hole of the organization’s security posture. In short, for those not currently working on the front-line: they’re bad.

But, just like the graphic designers, poets, authors, and artists who have been undermined by recent advances in AI, now those cybersecurity professionals who are considering a career change have another issue to deal with: LLMs, in particular GPT-4, seems to be capable of identifying and exploiting zero-day vulnerabilities for their malicious agent of disaster. That’s right, secpros - the LLMs are now coming for us professionals that are protecting the organizational assests. A while ago, the _secpro team interviewed a variety of our readers in order to take the pulse of public opinion regarding LLMs, their uses, and the potential future that lays before us. Sadly, for those of you who are interested in a bit of doomscrolling, this isn’t actually the terrible news that it sounds to be - but it certainly isn’t good.