AI-driven penetration testing uncovers critical open‑source bugs, fueling debate on automation

AI‑based pentesting tools have identified high‑severity vulnerabilities in long‑standing open‑source projects that conventional scanners missed. Notable findings include a 27‑year‑old authentication bypass in curl and a 16‑year‑old memory‑corruption flaw in FFmpeg, both discovered after AI systems reasoned about complex code paths and middleware logic. Traditional signature scanners such as ZAP and Burp Suite, as well as fuzzers like OSS‑Fuzz, failed to detect these issues because they rely on known attack patterns rather than contextual reasoning.

Security experts caution that, despite these successes, AI tools still lack the ability to understand attacker intent and often miss logical flaws that human penetration testers can exploit. The consensus is that AI should augment, not replace, manual testing, with automated scans handling breadth and human expertise focusing on depth and intent‑based vulnerabilities.