AI System NOVA Uncovers Thousands of Undocumented Vulnerabilities in Open Source
Palo Alto Networks' Unit 42 developed NOVA, an AI system that analyzed 3,915 open-source projects and identified 14,090 previously undocumented vulnerabilities, far exceeding existing public records.
Palo Alto Networks' Unit 42 has developed an innovative AI system named NOVA, which has demonstrated a remarkable capability in uncovering previously unknown software vulnerabilities. Over a two-month period, NOVA meticulously analyzed the source code of 3,915 open-source projects, ultimately identifying a staggering 14,090 distinct vulnerabilities. Each of these findings was rigorously validated through the system's internal pipeline, ensuring a high degree of accuracy.
Following its extensive analysis, the Unit 42 researchers cross-referenced NOVA's discoveries with publicly available vulnerability databases. The results were striking: only 85 of the identified flaws were already documented. Furthermore, the vast majority of these matched vulnerabilities were published weeks after NOVA had already pinpointed them, underscoring the system's advanced detection capabilities and its potential to significantly outpace traditional discovery methods.
While automated vulnerability discovery tools have been in use for years, with Google's OSS-Fuzz identifying over 10,000 flaws since 2016, NOVA represents a significant shift in the *type* of vulnerabilities it uncovers. Traditional fuzzing techniques excel at finding issues that cause program crashes, such as memory corruption or integer overflows. However, NOVA's findings reveal that only 8% of its discoveries fall into these 'fuzzing-friendly' categories. This indicates a substantial gap in current automated security testing, particularly for vulnerabilities that do not manifest as immediate crashes.
The majority of NOVA's findings, a substantial 92%, belong to categories where no visible malfunction occurs. These include critical issues like broken access control, where software fails to properly verify user permissions, and path traversal, code injection, prototype pollution, and server-side request forgery (SSRF) flaws. Detecting these types of vulnerabilities requires a deeper understanding and reasoning about the intended logic and behavior of the code, a task at which NOVA appears to excel.
Analysis of the vulnerability types varied significantly by programming language, reflecting the distinct architectural patterns and common weaknesses within different ecosystems. For instance, C and C++ codebases yielded a higher proportion of memory safety issues, while JavaScript and TypeScript projects showed a clustering of injection, prototype pollution, and SSRF vulnerabilities. In contrast, PHP, Java, and Python projects were predominantly affected by broken access control flaws, a common challenge in applications managing diverse user roles and permissions.
NOVA's analysis also shed light on the pervasive nature of supply chain risks. Within the examined package ecosystems, the system identified 5,421 supply-chain-related findings. Of these, 1,280 were direct flaws within dependency packages themselves. The remaining 4,141 were classified as 'downstream exposures,' meaning that an application's code reached and could potentially exploit a vulnerable dependency. Crucially, 2,776 of these downstream exposures were validated with working proof-of-concept exploits originating from the application itself, not just inferred from dependency graphs.
The implications of such rapid, AI-driven discovery are profound, particularly concerning the shrinking 'patch window.' Palo Alto Networks estimates the industry average for deploying traditional patches to be 55 days. However, once a fix is released, attackers can more easily reverse-engineer exploits by examining the code differences. NOVA's ability to find vulnerabilities much faster than they are documented or patched means an increasing number of flaws will be discoverable by attackers before defenders can even begin to address them.
Unit 42 is actively collaborating with open-source maintainers and vulnerability clearinghouses like Lightwell and Akrites to facilitate the remediation of these newly discovered flaws. However, the organization has not yet disclosed specific affected projects, assigned CVE identifiers, or detailed the timeline of reporting these issues. The severity of the vulnerabilities also varies, with CVSS 3.1 rating just over a quarter as high or critical, while CVSS 4.0 scores under two-fifths in those categories, highlighting the evolving landscape of vulnerability assessment.