Critical Tor Vulnerabilities Patched Across All Tor Components From the "LLM Report Firehose"

Tor has released updates for "all components" of Tor that include severe vulnerabilities and bugs from the "LLM report firehose" and recommends "upgrading as soon as possible."

Tor isn't the only project feeling the pressure from LLM-assisted. Many open-source projects have been bracing for the avalanche of AI security reports, many genuine but many others completely useless. Important open-source projects like curl have had to close their bug bounty programs because of low-quality AI submissions.

Still, in the right hands, AI tools can massively speed up the rate at which bugs can be found.

The Linux kernel has been removing older bits of code that aren't used much in order to reduce the attack surface in the face of LLM bug reports.

AI tools have even been able to surface bugs from over a decade ago. Those would have otherwise sat around waiting for a determined enough attacker to find them.

Mozilla has embraced using LLMs as defenders, claiming AI-assisted vulnerability discovery could finally turn the tide in the fight against attackers, but only after a front-loading your work with bug fixes for a while.

The vulnerabilities include memory corruption vulnerabilities, double-free bugs, and null pointer dereference bugs. Memory safety issues make up around 70% of all vulnerabilities according to Google's numbers.

Tor has been working on a rewrite of Tor in the memory-safe language Rust. Named Arti, the rewrite claims to make the main Tor component safer, faster to develop, and cleaner.

The Tor Project has said they will eventually replace the old C Tor codebase with the Rust Arti codebase. The Tor browser is based on Firefox, so it’s more reliant on the upstream developers to fix security issues.

The Tor project didn't release details on the vulnerabilities in order to give people time to patch to the fixed versions.

There's no mention that these exploits were used in the wild thankfully.

The current wave of AI security research is proving challenging for even the most well-funded projects, with Microsoft breaking records over and over again, nearing 1000 vulnerabilities in some updates.

Even still, it's better that these bugs are found by the developers of the software themselves and fixed as soon as they're able than for them to sit around for decades unnoticed.