The software you are running is almost certainly riddled with known, unfixed security bugs. These bugs can be trivially and quickly exploited by modern AI agents. This is not merely theoretical; I saw this during my sandbox escape research, and an old vulnerability in stable software was used as a part of the recently disclosed OpenAI hack: From the official hack description To say it simply: whatever you are running is almost certainly easily hackable by advanced AI. Luckily, there is a fix, and we (not just at Trail of Bits, but in the security industry more broadly) are working on it. But first, how did we get here? Stability versus security Software has bugs, and some are relevant to security. We try to fix them when we can, and the first place the fix happens is in the latest version of the software. Unfortunately, that’s often the only place where the fix happens. The process of getting a fix from the latest source code to older versions is called “backporting.” Fixes for big-name, critical bugs are indeed often backported quickly. But for many other bugs, the backporting process never happens. It is easy to understand why: software packaging is often done by volunteers who are already overworked, and backporting is frustrating, thankless work that gets little credit or publicity. For open source projects staffed by teams of volunteers, backports are (understandably) a low priority. The lack of backports is a problem because almost no one runs the latest and greatest version of software that’s been freshly built with today’s code changes. People overwhelmingly prefer slightly older, more tested software packaged in “long term stable” releases. For example, about 95% of Ubuntu Linux installations are of the Long Term Support (LTS) variety. When looking at installed Linux kernel packages from Debian’s popcon, the overwhelming majority are based on older stable trees: This is a Codex-generated graph of recently installed kernel packages from Debian’s popcon. The

Read Full Article at Trail of Bits Blog →