An AI cybersecurity startup has discovered a critical vulnerability in authentication software used by NASA for ground control communications with spacecraft — a flaw that survived undetected for three years despite multiple human code reviews and was fixed within four days by the same AI tool.
The vulnerability was found in CryptoLib, authentication software that protects communications between NASA’s ground control stations and satellites in space. According to researchers, the flaw could allow an attacker to inject arbitrary commands with full system privileges, potentially enabling remote hijacking of spacecraft or interception of data exchanged with ground control.
“The vulnerability transforms what should be routine authentication configuration into a weapon,” the researchers wrote. “An attacker can inject arbitrary commands that execute with full system privileges.”
The AI tool, developed by startup AISLE, uses an “autonomous analyzer” that systematically examines entire codebases for suspicious patterns. It discovered the vulnerability and helped develop a fix in just four days — a task that had eluded human reviewers for three years.
Gaining access to the spacecraft through the CryptoLib vulnerability would require attackers to have local system access at some point, which the researchers said reduces the attack surface compared to a remotely exploitable flaw. However, they emphasized that automated analysis tools are becoming essential as software systems grow increasingly complex.
“Human review remains valuable, but autonomous analyzers can systematically examine entire codebases, flag suspicious patterns, and operate continuously as code evolves,” the researchers said.
