The author seems to put a lot of stock in the whole “the blue team has access to these AI tools that the red team doesn’t currently have access to” argument
I didn’t read it like that. I think the point was that the red team had an edge over the blue team (by being able to spend a lot of effort on a single exploit), so when both teams have access to these same tools, it’ll be more of an equal fight.
Perhaps I misunderstood the author’s intent. Though even if their position is that the red team and blue team will be on a more even playing field when both have access to AI tools, I’m not sure I can agree with that assessment. The asymmetrical nature of offense and defense isn’t fundamentally changed by the advent of AI tools. While the current slate of AI tools may be uniquely more useful for finding and patching bugs, I can’t imagine a future in which AI tools aren’t also being tailored for exploiting and penetrating. The red team isn’t just going to sit around and not adapt the available toolset to favor their use cases as well.
Much like the arms race between anti-virus development and virus development, there will be defensive AI development and offensive AI development. Similar to what we’ve already seen with the arms race between LLMs and software that can detect if something was written by an LLM.
I didn’t read it like that. I think the point was that the red team had an edge over the blue team (by being able to spend a lot of effort on a single exploit), so when both teams have access to these same tools, it’ll be more of an equal fight.
Perhaps I misunderstood the author’s intent. Though even if their position is that the red team and blue team will be on a more even playing field when both have access to AI tools, I’m not sure I can agree with that assessment. The asymmetrical nature of offense and defense isn’t fundamentally changed by the advent of AI tools. While the current slate of AI tools may be uniquely more useful for finding and patching bugs, I can’t imagine a future in which AI tools aren’t also being tailored for exploiting and penetrating. The red team isn’t just going to sit around and not adapt the available toolset to favor their use cases as well.
Much like the arms race between anti-virus development and virus development, there will be defensive AI development and offensive AI development. Similar to what we’ve already seen with the arms race between LLMs and software that can detect if something was written by an LLM.