Vulnerability
Also written: Security flaw, Weakness, Context-dependent vulnerabilities, Backdoor vulnerability, Vulnerability research, AI vulnerability research, Coordinated Vulnerability Disclosure, CVD
A weakness in software or hardware that attackers can exploit to gain unauthorized access or cause damage.
A vulnerability is a security flaw. Think of it like a weak spot in a castle wall that an enemy could exploit to get inside.
In software, this could be a mistake in the code that allows a hacker to take control of a system, steal data, or disrupt services. For example, if a website doesn't properly check user passwords, a hacker might use a vulnerability to guess passwords and log in as someone else.
A vulnerability is a weakness in a system's design, implementation, or operation that can be exploited by a threat actor. This exploitation can lead to a compromise of confidentiality, integrity, or availability. Vulnerabilities can exist in software code, hardware configurations, or even human processes, and are often categorized by their severity and the type of exploit they enable.
Frontier AI labs are increasingly using AI to find and fix security vulnerabilities in software. Companies like OpenAI, Anthropic, and Google Gemini are developing AI models specifically for cybersecurity tasks, such as identifying exploitable flaws and speeding up the patching process. This focus highlights the growing role of AI in both offensive and defensive cybersecurity operations.
- Block on Finding and Fixing Security Risks with OpenAIOpenAI · OpenAI on YouTube ·
- An opt-in vulnerability-finding service for open-source softwareAnthropic · Anthropic Research ·
- Introducing the Anthropic Cyber MissionAnthropic · Anthropic News ·
- Codename MDASH brings agentic AI cybersecurity to the US governmentMicrosoft · Microsoft Source ·
- Outbound coordinated disclosure policyOpenAI · OpenAI Policies ·
- Coordinated vulnerability disclosure policyOpenAI · OpenAI Policies ·
- Daybreak models are now available on AWSOpenAI · OpenAI News ·
- Introducing Gemini 3.5 Flash CyberGoogle · Google DeepMind Blog ·
- LLM-discovered 0 daysAnthropic · Anthropic Research ·
- Making frontier cybersecurity capabilities available to defendersAnthropic · Anthropic News ·
- A small number of samples can poison LLMs of any sizeAnthropic · Anthropic Research ·
- Scaling security with responsible disclosureOpenAI · OpenAI News ·
- Announcing OpenAI’s Bug Bounty ProgramOpenAI · OpenAI News ·
- Anthropic Claude
- Anthropic is offering an AI scanning service to help find security holes in open-source code and is using AI to defend critical infrastructure.
- Google Gemini
- Google Gemini has introduced a cyber model designed to accelerate the process of finding and fixing software vulnerabilities.
- Microsoft Copilot
- Microsoft is employing agentic AI through its Codename MDASH to identify exploitable software flaws for US government cybersecurity.
- OpenAI ChatGPT
- OpenAI is leveraging AI to help find and fix software security flaws faster and has established policies for the responsible disclosure of vulnerabilities.
- Exploit
- An exploit is the actual method or tool used to take advantage of a vul
- Threat
- A threat is a potential danger that might exploit a vulnerability.
- Risk
- Risk is the likelihood of a threat exploiting a vulnerability and the resu
The concept of vulnerabilities originates from the field of computer security, evolving alongside the development of complex software and networked systems. Formal definitions and tracking systems like CVE (Common Vulnerabilities and Exposures) emerged to standardize the identification and communication of these weaknesses. Source ↗
You can explore how AI might identify potential security issues by asking a model to review a piece of code for common programming errors. For example, ask ChatGPT to 'find potential security vulnerabilities in this Python function' and provide a simple code snippet.
The Playbook: reusable how-tos, prompts, configs and tips pulled out of the news.
- ToolDaybreak models for cybersecurity on Amazon BedrockSpecialized cybersecurity AI models for vulnerability research, detection engineering, and incident response available via AWS. · 5 min
- PromptRole-play a student struggling with math for AI tutor simulationSimulate a student's math struggles and uncertainty for AI tutor evaluation. · 5 min
- TemplateReusable workflow templates for healthcare teamsTeams can create and share templates for common workflows like documentation or prior authorizations. · 15 min
- TemplateTemplate for building an AI tool tailored to your workA structured approach to defining and building a custom AI tool for specific business needs. · 15 min
- TemplateEvals CSV prompt list for agent skillsA CSV file template for listing prompts used in evaluating agent skills. · 20 min
Questions people ask
- What is the difference between a vulnerability and an exploit?
- A vulnerability is a weakness, like a hole in a fence. An exploit is the tool or method used to get through that hole, like a ladder.
- How are vulnerabilities found?
- Vulnerabilities are found through manual code review, automated security scanning tools, penetration testing, and increasingly, through AI models trained to identify patterns of weakness.
First seen on Subvolts Apr 11, 2023. Updated Oct 15, 2026. Written by an AI model from the items above and reviewed against them weekly; report an error.