Google calls the AI fuzz to find vulnerabilities

Not familiar with 'fuzzing'? It's a software testing technique that involves feeding invalid, unexpected, or random data into a program to detect coding errors and security vulnerabilities. Back in August 2023, Google introduced AI-Powered Fuzzing, using large language models (LLM) to improve fuzzing coverage to find more vulnerabilities automatically -- before malicious attackers could exploit them. Recently the company's OSS-Fuzz team reported 26 new vulnerabilities to open source project maintainers, including one vulnerability in the critical OpenSSL library (CVE-2024-9143) that underpins much of internet infrastructure. The team used AI-generated and enhanced fuzz targets to detect these vulnerabilities, representing a milestone… [Continue Reading]