That is the thinking behind a study by Ying Zhang, an assistant professor at Wake Forest University, and her doctoral advisors at Virginia Tech, Department of Computer Science, Associate Professor Na Meng and Professor Danfeng “Daphne” Yao.
At the heart of their work is a problem most people never see but affects everyone: Software vulnerabilities. Every time a person uses an app, buys something online, or interacts with a digital service, their data travels through invisible connectors called application programming interfaces, or APIs.
These weak points are everywhere. Modern applications are built in layers, stacking third-party libraries and external code on top of one another in ways that make it nearly impossible for a developer to track every potential risk. A flaw buried deep in one layer can ripple upward, quietly exposing systems that developers didn’t even know were at risk.
Human Problem
The problem isn’t just technical. It’s human. Developers, under constant pressure to ship working software, tend to treat security as an afterthought.
“Most of the time, security ends up considered a second-class citizen,” Meng said. “Developers often prioritize functionality over security, especially when the risks are not immediately visible.”
Meng and Yao’s approach to closing that gap is as clever as it is counterintuitive: to help defend software, they teach artificial intelligence to attack it.
Working with Zhang and the current Ph.D. students in computer science, the team developed a system that uses large language models – the same underlying technology that powers tools like ChatGPT – to automatically generate what researchers call “proof-of-concept exploits.” These are step-by-step demonstrations showing exactly how a real attacker could take advantage of a known flaw.
Pictured from left. Na Meng, Ying Zhang, and Danfeng “Daphne” Yao who conducted a study about finding software vulnerabilities by teaching AI to attack them.
Photos courtesy of the subjects.
The logic is simple but powerful. When a developer sees an abstract warning their software has a vulnerability, they may ignore it or put off fixing it.
“If developers need a strong motivation, they say, ‘Show me the exploit,'” Zhang said. “Then they will make the changes.”
In testing, the system successfully generated proof-of-concept exploits with a high level of reliability. That’s a meaningful leap forward in solving a problem that has long resisted automated solutions. The goal, Zhang said, is entirely defensive: to help developers understand and address risks before malicious actors find them first.
Capturing Attention
The novelty of the approach has gotten some high-level attention. OpenAI has showed interest in the project, an early sign it is resonating beyond academic circles.
A second major thread of the team’s research targets the software supply chain.
This complex web of dependencies connects modern applications. The team develops automated tools to identify which specific APIs within a piece of software are vulnerable, information that is often missing or incomplete and leaves developers without a clear picture of where to focus their security efforts.
“It’s hard for developers to conduct code inspections or vulnerability localization, missing this information,” Zhang said. “So we try to automatically derive it.”
As software grows more interconnected, that precision becomes more important. Knowing a vulnerability exists somewhere in a system is far less useful than knowing exactly where it is and what it would take to exploit it.