前沿 AI 能否强化网络防御？来自 Project Glasswing 的证据

View PDF HTML (experimental)

Abstract:Defenders and attackers race to find the same software flaws. I use the launch of Project Glasswing, which gave a small group of large US tech firms early access to Claude Mythos Preview, a model for finding software vulnerabilities, to study how access to frontier AI affects defenders, external researchers, and attackers. Using the universe of publicly disclosed vulnerabilities, I find that firms with access more than doubled their disclosures relative to Chinese and Russian tech firms without access, disclosed about 150 percent more high-impact vulnerabilities, and fixed reported flaws as quickly as before. As treated firms found more flaws themselves, external researchers, who sell their findings through bug bounties, reported about half as many vulnerabilities in treated firms' code and more in other firms' code, without leaving the market. There is no evidence that attackers exploited the additional vulnerabilities: the share exploited within a month of disclosure fell by about two thirds, mainly because a smaller share was already exploited when disclosed, while the number exploited did not change. Frontier AI helped defenders find and fix more flaws before attackers exploited them, but its restricted release creates an asymmetry in software security between firms in different countries.

Subjects:	General Economics (econ.GN); Artificial Intelligence (cs.AI)
Cite as:	arXiv:2611.06629 [econ.GN]
	(or arXiv:2611.06629v1 [econ.GN] for this version)
	https://doi.org/10.48550/arXiv.2611.06629 arXiv-issued DOI via DataCite (pending registration)

Submission history

From: Thomas Mosk [view email]
[v1] Wed, 4 Nov 2026 15:12:30 UTC (115 KB)