Georgetown’s Center for Security and Emerging Technology explores how LLMs are automating vulnerability discovery, patching, and exploitation verification across the software development lifecycle. AI tools can now narrow searches to specific vulnerable components during fuzzing and generate patches autonomously, shifting remediation earlier before attackers strike. Google’s Big Sleep agent reported 20 flaws, mostly in FFmpeg and ImageMagick, each found and reproduced without human help, though a human expert checks every report before it goes out. On the patching side, Google DeepMind’s CodeMender upstreamed 72 security fixes to open source projects in six months, and human researchers still review every patch before submission. What could possibly go wrong with automating exploit development?
