Security through obscurity is dead, and AI delivered the fatal blow

I was thinking about this earlier today. I've been reverse engineering some Sony camera firmware, and there's a bunch of obfuscated cryptography.

Executables packed with encryption, funky key derivation algorithms, and the likes. I'm used to dealing with this kind of thing, and in the past I'd just work my way through it. It'd take between "hours" and "days", but I'd get there in the end.

You could argue that the obfuscation was already useless, but it did provide a meaningful speed bump, and less determined reverse engineers would simply give up.

But with LLMs... I literally did not have to think about any of it. It just routes around it autonomously. Sure, I guess it had to burn a few extra tokens to deal with it, but the cost rounds to 0.

"The average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0 percent,' wrote Director of Security Research Keith Hoodlet, adding that even patches that did fix the flaw also mucked up the application’s behavior 20 percent of the time."

"'Conversely, LLM-generated patches did not resolve the vulnerability, added a new vulnerability, or both, an average 53.9% of the time,' Hoodlet said."

These are some interesting points. I wonder: why?

this is not really true. actually quite the opposite.

sure that things which were obscure now are easier to detect and find if they are open, but it is becoming trivial to create very complex systems as well as security systems using AI which will be really hard to defeat by other AI because its not something they have ready access to.

its not like suddenly AI can perform blind exploits on remote random targets.