AI opens two fronts in software security: finding flaws and tracing changes
A Security says public AI models helped uncover a serious Zoom flaw in one day, while IBM and Red Hat are combining identity, signing, and provenance checks for faster enterprise software pipelines.
Artificial Intelligence··Night
Faster investigation of the Zoom flaw
The Verge reports that Zoom patched a serious flaw that allowed an attacker to take over participants' devices during a meeting. The problem ran through the annotation feature used for drawing during screen sharing. By joining or hosting a meeting, an attacker could run malicious code on a victim's device, steal data, activate the camera or microphone, or install malware. A Security said the attack required no action from the victim and left no visual sign of compromise. Its researchers say they found the flaw with fewer than 20 prompts on publicly available AI models and produced a working exploit in one day. That speed is the researchers' own account; the report carries no independent comparison trial. Zoom released fixes on Tuesday for Windows, macOS, Linux, Android, and iOS. The episode provides a concrete company example of accessible models potentially shortening parts of the search and testing cycle in security research.[1]
Lightwell traces the identity of changes
InfoQ describes a different point in the software lifecycle. IBM and Red Hat are expanding the commercial capabilities of Lightwell, their software supply chain security platform. It builds on Sigstore, in-toto, SLSA, and software bill of materials work, bringing signing, provenance generation, policy validation, and lifecycle management into one place. The report ties the move to AI-assisted development increasing both the speed and the volume of changes entering enterprise pipelines. Organizations therefore want evidence that software was built in approved environments, signed with trusted identities, and left unaltered through its lifecycle, alongside code review and vulnerability scanning. Once an AI agent can generate code or change infrastructure, the identity behind an action can refer to a person or a system. Teams need to know who or what performed each step, under which identity, and according to which policies. Lightwell's announced expansion aims to answer that question by joining signatures, provenance, and policy information.[2]
Discovery speed and tracing work rise together
These developments address different stages of software security. The Zoom report follows the discovery of a flaw in a running product, the production of an exploit, and the release of a patch. The Lightwell report focuses on proving where software was built, which identity signed it, and which rules governed it throughout the lifecycle. There is no claim that Lightwell would have found Zoom's annotation flaw, and A Security's work does not measure the performance of supply chain provenance tools. The two stories still make the same time pressure visible from opposite sides. Accessible models may accelerate flaw discovery and exploit development, while AI-assisted development sends a larger volume of changes into enterprise pipelines. Each side of that speed requires a different control: searching deployed products for vulnerabilities and tracing every change through the build process. Software security consequently extends beyond scanning the final code. How a fix was produced, which identity signed it, and whether it remained intact through delivery also shape confidence in the software that reaches users.[1], [2]
