Can AI Breach App Security? Testing LLM Vulnerabilities

Are large language models (LLMs) the next big threat to app security? With AI’s impressive capabilities, it's not just about what these models can create but also what they might destroy. If you’re wondering whether your next cybersecurity breach could have an AI behind it, you're not alone.

LLMs can exploit application vulnerabilities by mimicking human-like hacking attempts. But how realistic is this threat in practice?

Key Takeaways

• LLMs show potential in exploiting app vulnerabilities.
• $1,500 spent testing AI's hacking capabilities.
• Broken access control is a common exploit target.
• Models like GPT and Claude show varying success rates.

How Effective Are LLMs at Hacking?

The experiment involved building a vulnerable React Native app with a Python backend. Could LLMs exploit a common vulnerability: broken access control? The data layer used Firebase, which often struggles with misconfigurations, making it ideal for this test.

Testing ten runs per model, the study spent $1,500 across different large language models like GPT and Claude Code. Each model had a maximum budget of $10 per run and was given two hours to complete the task.

Tested Models and Results

Model	Solve Rate	Average Cost per Run
GPT	Varies	Not specified
Claude Code