LATIDIA · Ciberseguridad

¿La IA ayuda a los ciberatacantes o a los defensores? Evidencia de vulnerabilidades no públicas y ataques posteriores

arXiv: 2610.06584v1 Tipo de anuncio: nuevo Resumen: La decisión de lanzamiento para los sistemas de IA de frontera se basa cada vez más en puntos de referencia de capacidad cibernética, pero los puntos de referencia de vulnerabilidad pública pueden exponer a los agentes a publicar previamente

La noticia

arXiv:2610.06584v1 Announce Type: new Abstract: The release decision for frontier AI systems increasingly relies on cyber capability benchmarks, yet public vulnerability benchmarks can expose agents to previously published advisories, exploits, and fixes, making it difficult to distinguish prior exposure from capability on unseen vulnerabilities. We evaluate open-weight and proprietary AI models on exploit generation, vulnerability repair and subsequent attacks in five nonpublic software environments, including vulnerabilities we privately disclosed while they remained unpatched. Researcher-developed and reviewed deterministic graders, not LLM judges, determine task scores. Comparisons with 209 disclosed vulnerabilities and cryptographic challenges reveal substantial variation across systems and vulnerability types. Repair scores exceed attack scores in two nonpublic environments and