Actualmente, el término «Inteligencia Artificial» está copando gran parte de los titulares, noticias y avances de la tecnología. Dentro del vasto mundo de las posibilidades de las llamadas «Inteligencias artificiales», una rama en específico, la generativa.

La rama generativa, como su nombre indica, permite crear contenido similar a como lo haria un ser humano, de forma autmatizada dandole unas pequeñas directivas sobre como debería de ser. Aunque inicialmente este contenido únicamente era texto escrito, con el avance en el desarrollo de la tecnología es posible generar imagenes, texto, sonidos, video, código informático y todo lo que podamos llegar a imaginar.

AI-driven 0-day detection is here. AI-assisted security research has been quietly advancing since early 2023, when AIxCC researchers demonstrated the first practical applications of LLM-powered vulnerability detection in AI systems. Modern LLMs have been used to improve the accuracy of detections of existing classes of web issues (XSS, SQLi, CSRF) and find business logic and authentication problems that were previously undetectable by SAST.

So what does this mean in terms of AIs' ability to do unsupervised security research? Since July 2024, ZeroPath is taking a novel approach combining deep program analysis with adversarial AI agents for validation. Our methodology has uncovered numerous critical vulnerabilities in production systems, including several that traditional Static Application Security Testing (SAST) tools were ill-equipped to find. This post provides a technical deep-dive into our research methodology and a living summary of the bugs found in popular open-source tools.