Researchers from the University of Illinois Urbana-Champaign have recently discovered that GPT-4, the most advanced iteration of a large language model (LLM), has the capability to identify security vulnerabilities without the need for external human assistance. This includes exploiting zero-day flaws by utilizing knowledge of common vulnerabilities and exposures (CVE).
The study, shared on the Arxiv repository by Richard Fang, Rohan Bindu, Akil Gupta, and Daniel Kang, acknowledged previous research demonstrating the capability of LLMs to autonomously hack websites. However, they noted that previous studies were limited to simple vulnerabilities. In this study, the researchers compiled a dataset of 15 critical severity vulnerabilities from the vulnerable list and common exposures to demonstrate how GPT-4 can act against them.
According to the research, GPT-4 was able to exploit 87 percent of the vulnerabilities, while GPT-3.5 was unable to exploit any. The researchers believe this success was enabled by the complete CVE descriptions of the vulnerabilities. They suggest that security organizations may consider refraining from publishing detailed reports on vulnerabilities as a mitigation strategy.
To prevent cybercriminals from exploiting ‘zero-day’ vulnerabilities using GPT-4, the researchers recommend proactive security measures such as regular security package updates. They stress the importance of staying ahead of potential threats posed by advancements in language models.
In conclusion, LLMs such as GPT-4 have become increasingly capable in identifying and exploiting security vulnerabilities without human intervention. As such, it is crucial for security organizations to implement proactive measures and stay vigilant in order to protect against potential threats posed by these advanced models.