EP290 Project Atlas: Wiz's AI Vulnerability Research

The podcast opens with hosts Tim Peacock and Robert Patrick discussing the evolving landscape of cloud security, emphasizing how AI is revolutionizing threat detection and vulnerability hunting. They highlight the dual nature of AI advancements—being both impressive and potentially terrifying—with recent successes in discovering cross-tenant data access vulnerabilities in major platforms using AI within hours, showcasing the rapid pace and power of AI in security research.

Nearest, the guest speaker from Wiz, explains the origins of Project Atlas—a project focused on using multiple specialized AI agents to uncover vulnerabilities in cloud environments. He details how their system employs different models for specific tasks like understanding code, finding vulnerabilities, validating exploits, and explaining findings. This multi-model approach allows for continuous improvements, with each new model replacing less effective ones, creating a flexible and ever-improving system. Nira discusses the significant impact of AI, enabling researchers to find hundreds of vulnerabilities in a fraction of the time previously needed, and shares how AI contributed to discovering critical vulnerabilities in open source components and enterprise systems like GitHub and Azure Cosmos DB.

The podcast features remarkable case studies, including a record-breaking vulnerability in GitHub that was discovered by Wiz in just 48 hours using AI tools. This vulnerability involved a simple command that allowed remote code execution, which was then demonstrated to work directly on GitHub.com, granting access to sensitive repositories. Similarly, Wiz uncovered a critical flaw in Azure Cosmos DB involving a master key that could potentially allow an attacker to access all databases and even retrieve internal service information. These cases illustrate the capabilities of AI to rapidly identify and exploit complex security issues in widely used cloud infrastructure.

The discussion emphasizes that AI support enhances human capabilities rather than replacing them. Wiz's researchers, exemplified by Sergei, leverage AI to perform complex tasks like reverse engineering and code analysis that previously took months in just hours. While AI automates many processes, human intuition, instinct, and expertise remain vital for validating findings and guiding research directions. The episode stresses the importance of scientific evaluation, rigorous testing, and continuous iteration in AI-based security work, countering fears that AI might render human researchers obsolete.

Nira shares insights into their technical approach, including breaking down vulnerability research into deterministic, manageable tasks, and the benefit of employing multiple AI models for different stages of the process. She recounts experiments like removing reconnaissance steps to improve vulnerability detection rates, illustrating that AI models excel when given clear, limited tasks. They also discuss how collaborative AI-human workflows, such as asking questions and interpreting assembly code with AI assistance, have drastically accelerated research outcomes and expanded the scope of possible discoveries.

The episode concludes with reflections on how AI is amplifying the scale and impact of vulnerability research, allowing security professionals to pursue more ambitious goals. While considerable progress has been made, the hosts acknowledge that human insight and experience still play a crucial role. The discussion closes with practical advice for security teams to invest in validation pipelines for AI-generated vulnerabilities and a nod to the ongoing importance of human expertise in cybersecurity.