Palo Alto Networks AI uncovers 14,090 vulnerabilities in open-source software
Artificial intelligence is already identifying software vulnerabilities that had previously gone undetected, at a scale that is creating new challenges for digital security.
Palo Alto Networks reported that its autonomous AI system, NOVA, identified 14,090 previously unknown vulnerabilities across 3,915 open-source software projects during a two-month evaluation.
Artificial intelligence is already identifying software vulnerabilities that had previously gone undetected, at a scale that is creating new challenges for digital security.
Palo Alto Networks reported that its autonomous AI system, NOVA, identified 14,090 previously unknown vulnerabilities across 3,915 open-source software projects during a two-month evaluation. Of those findings, 99.4% had not been publicly disclosed, and nearly 40% were classified as high or critical severity under CVSS 4.0.
An autonomous system for vulnerability research
The system is designed to autonomously perform much of the vulnerability research process, from analyzing source code and identifying potential flaws to generating proof-of-concept exploits, validating findings and preparing disclosure materials.
NOVA uses a multi-agent architecture to review software repositories, analyze source code, identify and prioritize potential vulnerabilities, generate and validate proof-of-concept exploits, prepare disclosure reports and generate patch candidates and defensive recommendations.
Combining models expands coverage
The research also found differences among the AI models used during the tests. Each model identified vulnerabilities that others did not detect, suggesting that they can specialize in different aspects of code analysis.
Combining multiple models improved overall coverage, particularly in larger and more complex software projects.
Another finding involved the type of flaws identified. Some 92% of the vulnerabilities found by NOVA fell into logical and semantic vulnerability categories, including access control and authorization flaws, path traversal, code injection, prototype pollution and server-side request forgery (SSRF).
The study shows that AI can expand the scope of automated discovery to vulnerabilities that have traditionally relied more heavily on manual analysis, while accelerating the identification and validation stages.
The software supply chain is also exposed
The analysis also examined the software supply chain. NOVA identified 5,421 findings in this area, including 1,280 vulnerabilities in dependency packages that led to 4,141 downstream exposures.
Of these, 2,776 exposure paths were validated through functional proof-of-concept exploits, showing how vulnerabilities in open-source components can affect applications that depend on them.
The study also points to a shift in response times to vulnerabilities. If flaws can be identified and validated in days rather than months, organizations have less time to assess risks and implement mitigation measures.
As the volume and speed of discoveries increase, organizations may need faster processes for validation, coordinated disclosure and mitigation to reduce exposure before official software updates become available.
At the same time, human expertise remains necessary to validate findings, prioritize risks, manage responsible disclosure and develop mitigation strategies.
The study presents autonomous vulnerability discovery as an emerging capability that could transform software security research and defensive cybersecurity, while organizations face increasingly narrow windows between vulnerability discovery, disclosure and potential exploitation.
|
|
