Researchers from Nanjing University and the University of Sydney have developed A2, an advanced AI vulnerability detection agent that markedly improves upon its predecessor, A1. A2 successfully identifies and verifies vulnerabilities in Android applications, boasting a 78.3% coverage rate on the Ghera test suite—far surpassing the 30% achieved by the static analyzer APKHunt. In tests on 169 real APKs, A2 discovered 104 zero-day vulnerabilities, 57 of which were validated through automatically generated exploits, including a significant flaw in a popular app with over 10 million installs. A2’s unique validation module enables it to confirm vulnerabilities in a step-by-step manner, enhancing accuracy and reducing false positives. This architecture integrates several commercial language models, streamlining the vulnerability detection process at a cost-efficient range. As this field evolves, experts foresee an increase in both defensive and offensive cyber activities, emphasizing the importance of reducing alerts to focus on genuine threats.
Source link
