Cybersecurity researcher Mohan Pedhapati fortalte, how he used the AI model Anthropic Claude Opus 4.6 to write a complete exploit chain for hacking the JavaScript V8 engine in Google Chrome 138, which is used by the current Discord client.
The process of writing the exploit chain took a week, the researcher reported — it involved 2.3 billion tokens and $2283 spent on access to the AI model via the API; he also contributed his own efforts, spending a total of 20 hours solving deadlock issues. The cost of creating the hacking scheme seems significant for an individual, acknowledged Mohan Pedhapati; on the other hand, without external help, a person would work on a similar project for several weeks. The project also turned out to be economically beneficial — the reward from Google and Discord for reporting such an exploit could be around $15,000. And this is only the legal market — cybercriminals might pay a different amount for a zero-day vulnerability.
Many services release their applications on the Electron framework, which is based on Chrome — this is done not only in Discord but also, for example, in Slack. However, the current code of the framework is one version behind the browser, and app developers do not always quickly update dependencies, nor do users always install the latest versions of applications. The Discord client was chosen by the researcher because it runs on Chrome 138, which is nine major versions behind the current browser version.
Enhver begynderprogrammet, siger Mohan Pedhapati, kan med tilstrækkelig tålmodighed og en API-nøgle til adgang til AI-modellen bryde igennem uopdateret software - "det er et spørgsmål om tid, ikke sandsynlighed". Desuden er "hver patch i princippet en ledetråd til et exploit", fordi open source-projekter udvikles gennemsigtigt, hvilket betyder, at rettelser ofte er offentligt tilgængelige i koden, før den samlede opdaterede version af programmet frigives. For at beskytte applikationer mod sådanne angreb anbefaler eksperten at holde øje med afhængighederne og hurtigt lave ændringer samt automatisk udsende sikkerhedspatcher, så brugersoftware ikke forbliver sårbar, hvis opdateringen blot bliver glemt. Endelig bør open source-projekter være forsigtige med offentligheden af detaljerede oplysninger om sårbarheder.
Kilde:
Kilde: 3dnews.ru
