💻 computer science

Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act

This paper argues that the EU Cyber Resilience Act's static, process-based compliance framework is fundamentally incompatible with the continuous, AI-driven acceleration of vulnerability discovery and exploitation, necessitating a shift from one-time certification to perpetual, agent-operated security.

Original authors: Víctor Mayoral-Vilches

Published 2026-07-09

📖 6 min read🧠 Deep dive

CC0 1.0

Original authors: Víctor Mayoral-Vilches

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: A Law Built for a Different World

Imagine the European Union passed a new law called the Cyber Resilience Act (CRA). Its goal is to make sure the gadgets we buy (like smart fridges, robots, or cameras) are safe.

The law is smart about one thing: it admits that no software is perfect. You can't promise a product will never have a bug. So, instead of demanding "zero bugs," the law demands a process. It says: "Manufacturers, you must check for bugs, fix them when you find them, and tell us if someone is actively hacking your product."

The authors of this paper argue that this law was written for a world that no longer exists. It was designed when finding computer bugs was slow, expensive, and required a human expert. But today, AI agents (computer programs that act like autonomous hackers) have changed the game. They can find bugs instantly, cheaply, and in the millions.

The paper argues that while the law can handle the volume of bugs, it completely breaks when faced with the speed and nature of these AI hackers.

The Four Rules the Law Relied On (And How AI Broke Them)

The law assumes four things about how the world works. The paper calls these "Premises." AI has falsified all four.

1. The "Human Scarcity" Rule (Premise P1)

The Old World: Finding a bug was like finding a needle in a haystack. It took a skilled human detective days or weeks to find one. Because it was hard, there weren't many bugs found at once.
The AI Reality: AI agents are like a swarm of 1,000 super-fast detectives. They can scan a haystack and find 1,000 needles in a second.
The Result: The law Bends here. It can handle this. The law just says, "You don't have to fix every needle; just show us you have a good system for deciding which ones are dangerous." The process flexes to handle the volume.

2. The "Snapshot" Rule (Premise P2)

The Old World: When you sell a product, you check it. If it's clean today, you get a "Safe" certificate. You assume it stays clean for a while.
The AI Reality: AI can look at a product tomorrow and find a brand new bug that didn't exist (or wasn't known) today. The product hasn't changed, but the "Safe" certificate is now a lie.
The Result: The law Breaks. The certificate is like a photo of a person taken yesterday. If they get a haircut today, the photo is still "true" of the past, but it's useless for identifying them now. The law certifies a "ghost"—a secure product that no longer exists.

3. The "Discrete Event" Rule (Premise P3)

The Old World: Hacking was like a burglar breaking a window. You hear a crash, you know it happened, and you call the police (report the incident).
The AI Reality: AI hackers are like a gentle, constant wind that erodes the wall. They are probing your product 24/7. There is no single "crash" to report; the attack is just the background noise of the internet now.
The Result: The law Breaks. The law says, "Report it if you see active hacking." But if hacking is constant and invisible, you can't trigger the report. The alarm system is broken because the fire is now a slow smolder, not a sudden explosion.

4. The "Race to Fix" Rule (Premise P4)

The Old World: If a bug is found, the company has time to fix it and send an update before hackers use it.
The AI Reality: AI hackers can turn a discovered bug into a weapon in minutes. By the time a human company finishes a meeting to discuss a patch, the AI has already exploited the bug on millions of devices.
The Result: The law Breaks. The law says, "Fix it without delay." But you cannot race a bullet with a bicycle. The timeline has collapsed; the race is unwinnable for humans.

The Core Problem: Certifying Ghosts

The paper uses the phrase "Certifying Ghosts."

Imagine a health inspector visits a restaurant, checks the kitchen, and gives it a "Healthy" stamp. But, the moment the inspector leaves, a magical virus appears in the food. The restaurant is now unsafe, but it still has the "Healthy" stamp because the inspector only checked the process and the moment.

The CRA is doing this with software. It is stamping products as "Secure" based on a snapshot in time. But because AI hackers can change the security landscape instantly, that stamp is a lie the moment it's printed. The law is certifying a security posture that has already vanished.

The Solution: The "Robot Immune System"

The paper doesn't just say the law is broken; it offers a cure. It argues that we cannot go back to humans checking things slowly. We must use the same weapon the hackers are using: AI Defenders.

The Analogy: Instead of a security guard who walks the halls once a day (the current law), you need a digital immune system that lives inside the robot or device.
How it works: This AI defender constantly watches the device. If an AI hacker tries to break in, the defender spots it, blocks it, and fixes the hole in milliseconds—faster than the hacker can react.
The Proof: The authors tested this on two real robots: a humanoid robot and a robotic lawn mower.
- Without the AI Defender: The hacker took control of the robots in seconds.
- With the AI Defender: The hacker was blocked before they could do any real damage. The robot kept working safely.

The Conclusion

The paper concludes that the Cyber Resilience Act is a well-made law for a world that has already left the building.

The Fix: We need to stop treating security as a periodic check-up (like a yearly doctor's visit) and start treating it as a continuous, live defense (like an immune system).
The Warning: If the EU waits until 2027 to fully enforce this law without updating it, they will be handing out "Safe" certificates to products that are already vulnerable to AI attacks.
The Call to Action: Security must become continuous and run by AI agents. It's no longer a choice; it's the only way to survive the current threat landscape.

In short: You can't use a paper map to navigate a city that is being rebuilt every hour. The law needs to stop looking at the map and start driving the car in real-time.

Technical Summary: Certifying Ghosts: How Cybersecurity AI Agents Break the EU Cyber Resilience Act

Problem Statement
The European Union's Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, establishes a process-oriented regulatory framework for cybersecurity. Rather than guaranteeing vulnerability-free products, it mandates that manufacturers assess risk, handle flaws, and report incidents. The paper argues that this framework relies on four tacit premises about the vulnerability ecosystem that were valid when the legislation was drafted (pre-ChatGPT, 2022) but are now falsified by the emergence of Cybersecurity AI (CAI) agents.

The four premises are:

P1 (Human-Scarce Discovery): Finding vulnerabilities is slow, skilled, and human-intensive.
P2 (Point-in-Time Knowability): A product's exploitable flaws are knowable and static at the moment of market placement.
P3 (Discrete Exploitation): Active exploitation is a rare, detectable event.
P4 (Remediation Pace): The time between discovery and weaponization is long enough for scheduled updates to keep pace.

The paper posits that CAI agents—AI systems designed to discover, weaponize, and exploit vulnerabilities in other products—collapse the tempo, economics, and symmetry of the vulnerability lifecycle, rendering the CRA's "point-in-time" certification model obsolete before it fully enters into force in December 2027.

Methodology
The authors employ a legal-technical stress-testing methodology, mapping specific mechanisms of the enacted CRA text against the capabilities of current CAI agents.

Textual Reconstruction: The authors reconstruct the CRA's process orientation from the regulation's articles and annexes, identifying the four load-bearing premises.
Capability Mapping: They correlate specific CRA mechanisms (e.g., Article 14 reporting triggers, Annex I conformity assessments) with empirical data on CAI agent performance. This includes citing dated primary sources (e.g., GPT-4 exploiting 87% of one-day CVEs, DARPA AIxCC identifying zero-days, agent teams reaching real zero-days).
Bend vs. Break Analysis: The authors categorize the impact of CAI agents into two regimes:
- Bends: Where the regime flexes under load (volume) but remains logically intact.
- Breaks: Where the regime fractures because the environmental premises (P2–P4) are withdrawn, making the certification invalid regardless of process diligence.
Empirical Validation: The proposed remedy is tested on two CRA-scope robots (a Unitree G1 humanoid and a Hookii robotic lawn mower). These were subjected to offensive CAI agents first in an undefended state, and then with an "Agent-Native Remedy" (the Robot Immune System, RIS), a continuous, agent-operated defensive layer.

Key Contributions

Premise-Level Decomposition: The paper provides the first provision-by-provision mapping of the CRA against CAI dynamics, distinguishing between mechanisms that "bend" (can be re-interpreted) and those that "break" (require new regulatory constructs).
The "Bend vs. Break" Framework:
- Bends (P1): The regime holds under the sheer volume of vulnerabilities surfaced by agents. Compliance shifts from "remediate everything" to "demonstrably prioritize."
- Breaks (P2–P4): The regime fails due to the speed and symmetry of agents. A product certified as secure at time $t$ becomes exploitable at $t+1$ without any product modification, because the environment's ability to find flaws has changed. This invalidates the "point-in-time" certificate.
Agent-Native Remedy: The paper proposes that the only viable solution is to shift conformity from a periodic human process to a continuous, agent-operated posture. This involves using defensive CAI agents to re-probe products against current offensive capabilities in real-time, effectively making security a live subscription rather than a static snapshot.
Hardware Validation: The authors demonstrate that an agentic defender (RIS) can contain frontier-class offensive agents on physical robots, reducing attacker success rates from ~75–79% to ~8–14%, while maintaining system availability.

Results

Regime Stress: The analysis confirms that while the CRA can absorb the volume of agent-discovered vulnerabilities (Bend), it cannot survive the collapse of the vulnerability lifecycle (Break). Specifically, the "actively exploited" trigger (Art. 14) loses discriminating power when exploitation becomes ambient, and the "no known exploitable vulnerabilities" condition (Annex I) becomes practically empty when latent flaws can be rediscovered on demand.
Predictions: The paper outlines six falsifiable predictions for 2028, including the loss of discriminating power in the "actively exploited" trigger, the challenge to point-in-time conformity when conformant products are compromised by environmental shifts, and the eventual proposal of environment-triggered re-assessment mechanisms.
Defensive Efficacy: In controlled evaluations, the Robot Immune System (RIS) successfully detected, classified, and contained offensive CAI agents within seconds (<8s for the humanoid, <12s for the mower), preventing root access and safety overrides. This proves that defensive agents can track offensive agents, creating a statistical equilibrium rather than an attacker runaway.

Significance and Claims
The paper claims that the CRA is not "wrong" in its design but is "early to its own obsolescence," having been calibrated to a threat model abandoned years before its full enforcement.

The Core Argument: The mismatch is not with the regulated product but with the adversary landscape. A static certificate cannot attest to a security posture in a world where the adversary's capability is a dynamic, external variable.
The Necessity of Change: The authors argue that security must transition from a periodic, human-run process to a continuous, agent-operated one. This is not a matter of preference but of survival; the "point-in-time" certificate is certifying "ghosts"—security postures that no longer exist.
Constructive Stance: The paper positions itself as a constructive critique from within the European cybersecurity community. It argues that the same AI capability that breaks the law (offensive agents) provides the material to fix it (defensive agents). The authors urge regulators to treat the upcoming review not as a routine update but as a critical moment to introduce "adversary-capability baselines" and continuous conformity mechanisms, warning that waiting until 2027 to address this will result in a regulatory machine certifying a landscape that has already vanished.