arXiv: Evaluating Open-Weight LLMs for Generating Structured Threat Information for Autonomous Vehicle Vulnerabilities

This publication from arXiv presents a research study evaluating the ability of open-weight large language models to generate structured threat information specifically targeting vulnerabilities in autonomous vehicles. The paper assesses how these models can produce machine-readable threat intelligence, such as STIX-formatted reports, which could be used to automate vulnerability detection and response in autonomous driving systems. While not a regulatory mandate, the research highlights a growing capability gap that regulators and industry standards bodies may soon address, particularly under the EU AI Safety framework.

The primary affected sectors are automotive manufacturers, autonomous vehicle software developers, and cybersecurity firms providing threat intelligence services. Compliance teams in these organizations should also note implications for supply chain risk management, as open-weight models could be used by third parties to generate or exploit vulnerability data. Regulators may begin to scrutinize how such models are deployed in safety-critical contexts, especially under the EU AI Act’s high-risk classification for transport systems.

Compliance teams should immediately review their current threat intelligence pipelines to assess whether any open-weight LLMs are being used to generate or process vulnerability data. They should document model provenance, training data sources, and output validation procedures. Additionally, teams should monitor the EU AI Office’s upcoming guidance on foundation models and prepare to align with any forthcoming requirements for transparency, risk assessment, and human oversight in AI-generated threat information for autonomous vehicles.