AI-Powered Bug Hunting: A ClickHouse Case Study

AI as a Security Research Co-Pilot

The article presents a compelling case for using large language models (LLMs) like GitHub Copilot, Claude, and Gemini in the intricate field of vulnerability research, particularly within large C++ codebases like ClickHouse. The author's approach, moving from broad exploration to hypothesis generation and finally to automated proof-of-concept (PoC) creation, is a logical and effective methodology. The emphasis on 'naivety' as a strength, allowing for deeper exploration where experts might stop, is a crucial insight. The detailed breakdown of the prompt engineering process, including the iterative 'Why?' and 'How?' questions, and the structured PoC generation template, provides practical guidance. This demonstrates a significant step beyond basic AI code completion, showcasing AI's potential to augment complex analytical tasks and accelerate discovery in security.

However, a key limitation lies in the inherent nature of LLMs: their susceptibility to hallucinations and false positives. The author acknowledges this, noting that convincing findings are often inaccurate. The reliance on manual verification and the need for human expertise to guide the AI and validate its outputs are critical. The article also highlights the dynamic and rapidly evolving LLM landscape, implying that the described workflow might require constant adaptation. Furthermore, while the article focuses on vulnerability research, the broader implications for database security and the potential for AI-assisted attacks are also significant, though not deeply explored here. The success of this methodology is also contingent on the quality and specificity of the prompts, which can be a steep learning curve for less experienced users.

Key Points

• The author successfully used AI tools (GitHub Copilot, Claude Opus, Gemini) to find real vulnerabilities in the ClickHouse C++ codebase.
• The approach involves using AI for code review, hypothesis generation, and speeding up validation in local environments.
• Naivety and persistence were key factors, enabling exploration of complex paths that seasoned researchers might dismiss.
• The process includes iterative prompting, using 'Why?' and 'How?' to refine AI outputs, and a structured template for generating reproducible vulnerability reports.
• AI can significantly accelerate vulnerability discovery by augmenting human expertise, especially in large and complex codebases.
• The author emphasizes the importance of manual verification to mitigate AI hallucinations and false positives.

---

📖 Source: How I hunt for vulnerabilities with AI