Wiz CTO：AI 把漏洞利用开发周期从 22 天压缩到数小时
Wiz 的 CTO 说，以前写一个漏洞利用要 22 天，现在用 AI 几小时搞定，整个窃取密钥的攻击 20 分钟跑完。他建议给 AI 密钥设用量上限，不然被盗刷账单会很惨。做 API 产品的开发者都该听听。
Wiz 联合创始人兼 CTO Ami Luttwak 表示，过去专业攻击者开发一个可用漏洞利用平均需要 22 天，而近期借助 AI 辅助的案例已将时间压缩到数小时。他描述的典型攻击场景是：初创公司安全团队一觉醒来发现攻击者已入侵，整个攻击从进入系统到窃取所有客户 AI 密钥只需约 20 分钟。
Luttwak 给出两条具体建议：一是给 AI API 密钥设置用量上限，避免密钥被盗后被刷出高额账单——他表示这种损失在现实中很常见；二是凡是被攻击者盯上的公司，无论规模大小，都需要把安全放在更高优先级。
对开发者和初创公司而言，这轮变化的核心是攻击成本曲线被 AI 大幅压低，过去以周计的攻击准备周期降到小时级，安全预算和密钥管理策略需要按新节奏重新评估。
A working exploit once took a professional a median of 22 days to develop. Recent AI-assisted examples have taken hours. @amiluttwak : " If you have AI keys, it's probably better to put a limit on them... If you have a target on your back, you do need to put a lot of focus on security." a16z @a16z Wiz co-founder and CTO Ami Luttwak says cyberattacks on startups can happen faster than ever: "I work with the CEOs of startups that are getting attacked. Let's just be in their shoes. You wake up, and your security team says, 'Something bad happened overnight. We tried to stop it, but they got in.'" "The entire attack, again, takes 20 minutes... from the time they get in until they take all of the secrets, all of the AI keys of all of the customers. And now you have to figure out what are you going to say to all of the customers, and what you're going to do." "But if I'm a startup, especially if I have anything attackers want... I am on their target. It doesn't have to be a big company." "If you have AI keys, probably better to put a limit on them, because if they steal them, you don't wanna get a lot of charges, which we see happen a lot, and it's really, really sad. But also make sure that if you have a target on your back, you do need to put a lot of focus on security." @amiluttwak
This report is categorized under AITOP's "Industry" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows. Key entities and technical topics under continuous tracking include Wiz, AI safety, API keys, cybersecurity.
Source attribution: curated from a16z (@a16z).
