AI-Assisted Validation
Is an AI-found weakness real?
Candidate generation is cheap. Validation is the work. A model report is not a finding until a human can write the invariant and the data flow.
- → Candidate generation
- ↓ False-positive filter
- ↓ Reachability
- ↓ Exploitability / impact class
- ↓ Patch verification
- ↓ Disclose or discard
- AI Vulnerability Research #01: False Positive
- AI Vulnerability Research #02: Reachability
- AI Vulnerability Research #03: Exploitability
- AI Vulnerability Research #04: Patch Verification
Notes
09/AI Vulnerability Research/AI-Assisted Validation
How to Validate an AI-Generated Vulnerability
AI can propose candidates. The laboratory only publishes what a human can trace: false positive, reachability, exploitability, patch.
Series opener: why candidate generation is not research, and how we validate AI-suggested weaknesses without turning the blog into an exploit mill.
Read the journal note
FAQ
Questions
- Why are AI-found vulnerabilities often wrong?
- Models over-report sinks, miss dead code, and skip reachability. Candidate generation is cheap. Validation — false positive, reachability, exploitability, patch verification — is the work.