Google AI Finds Sandbox Escape Bug in Chrome's Codebase

Highlights

Google Chrome’s 13-year-old bug detected by all-new AI vulnerability agent, says Google.
Google is planning to further improve its core AI infrastructure in the coming year.
Google Chrome gets a new dedicated AI vulnerability agent to help find bugs.

Live

Hardik Jagda

CEO Proximity

AI is becoming central to modern sports broadcasting

Andrew Bonwick

Vice President of Product Development at Relm Insurance

How insurance and risk models are evolving to support satellite connectivity

Madhav Sheth

CEO of Ai+ Smartphone

Bold attempt to design smartphones specifically for Indian consumers.

Stephen Rose

CEO Render Networks

Why execution in the trenches may be the real key to AI readiness

Google AI Finds Sandbox Escape Bug in Chrome’s Codebase

Google is using AI to improve security in its Chrome browser codebase. Recently, the California-based giant announced its new AI vulnerability agent, created with its Gemini security LLM model. It detected a long-lived sandbox escape bug that could trick Chrome into reading local files. The bug went unnoticed for over 13 years, says Google.

Make Telecom Talk My Trusted Source

Key Highlights

Google Uses AI for Cyber Security Vulnerability Testing and Discovers a 13-Year-Old Bug in Chrome’s Codebase.
Google plans to add more AI features to its core offerings.
The new AI Vulnerability agent finds a Sandbox Escape bug that could give access to the local files.

Google also announced tweaks to the security LLM model to ensure security integrity. They are adding restrictions to set boundaries for the AI agent when detecting vulnerabilities.

Moving forward, Google is scaling up AI to automate bug validation, triaging, and fixing, tasks that usually rely on human expertise. Here is everything we know so far:

Also Read: Google Pixel 11 Pro Fold Design, Renders Surface

Google’s Vulnerability AI Agent Fixes the 13-year-long Sandox Bug

Since the AI boom, Google has been building a dedicated trusted AI agent to streamline operations.

Google has worked on LLM models for years and in 2023 used them to improve overall performance. Adding AI to core security is a crucial initiative for a company like Google.

To make this a success, Google spent years collaborating and building multiple projects to build an AI agent from scratch.

Google collaborated with Naptime on Project Zero and developed an AI vulnerability agent with research capabilities.

The following year, in collaboration with DeepMind, Project Zero and a new project called Big Sleep helped build an AI vulnerability agent that can research, find, and fix bugs within Google’s core codebase.

Surprisingly, the AI vulnerability agent turned out to be way more efficient and was able to find a major Sandbox escape bug that could potentially allow users to access local files by tracking the browser.

This bug was not notified and stayed in the codebase for over 13 years!

Also Read: Google Quietly Rolls Out New Signature App to Pixel Phones

Are Sandbox Escape Bugs Really Concerning?

openai cyber security ai agent finds sandbox escape bug

The bug has not compromised Google Chrome’s security integrity so far. Thanks to the AI vulnerability agent, Google’s security team was able to fix it before any attacks occurred.

Sandbox escape can be a major issue in today’s rising security attacks on the core infrastructure of technology giants.

Recently, OpenAI faced a problem with two of its LLM cybersecurity models during testing.

The AI models reportedly found a sandbox escape bug within this restricted environment, giving access to the internet and allowing them to hack into the Hugging Face infrastructure to meet benchmark standards.

Although the attack was reported, OpenAI and Hugging Face have acknowledged the situation and are collaboratively working to strengthen security.

Also Read: Apple Shakes Hands with Google for Powering Siri

Google’s Pillar Towards AI Agent Harness – Setting Boundaries for AI Agent.

Google is taking a step forward with an agent harness procedure that will strongly restrict what the AI agent can access.

According to Google’s release, they have built five pillars to keep security guardrails up and prevent AI from being manipulated. These include:

– Support for model interoperability where a specific agent specialises in a specific operation and can connect to another agent specialised in a different operation. For example, an agent can be built for research, and its results can be used by another agent specialising in finding or notifying bugs.

– A dedicated knowledge base will be established, including Chrome’s entire Git history, to expand the LLM’s reasoning capacity beyond its training date.

– Encourage developers to add Security.md files, which help define boundaries and provide an accurate view of threat models.

– A dedicated critic agent can be built separately to access these Security.md files.

– Allowing vulnerability-finding models to run over the codebase multiple times to help overall improvement.

This initiative will reduce overall manual workload and improve security integrity.

Every article you read here is the result of time, research, and effort. If you feel it adds value, you can support TelecomTalk.

FAQs

What did Google's AI vulnerability agent discover?

According to Google’s release, the new AI vulnerability agent identified and helped fix a 13-year-old Chrome sandbox escape bug that remained undetected until now.

What is the Google AI vulnerability agent?

Google AI vulnerability agent is an AI-powered security agent built using Google’s Gemini security LLM to detect, validate, and help fix software vulnerabilities and roadblocks