That agents with virtually unlimited computing resources can find these bugs is not surprising and of little interest at this point.
But can they fix and harden the software without introducing new bugs in the meantime? I would argue that over decades we have placed the industry in such feature hell that there will always be new critical attack vectors.
Now that writing the walls of code and building features is cheap, it is time for us, humans, to learn to reduce complexity in the software and to learn which features are not worth implementing.
With Anthropic/OpenAI preventing everyone else from doing this with their models, doesn't that just mean China gets a first look at most newly discovered vulnerabilities?
Z.ai has been very amenable to writing/developing exploits; the best you can do with Claude is have Opus 4.8 give you a security review.
>> Fixing the existing backlog only solves half the problem; the other half is cutting the rate at which new vulnerabilities enter the codebase. For that, we recommend scanning at PR time. We built security guidance directly into our development process through a Claude Code plugin, which we’ve released publicly.
This both makes sense and is likely very juicy for their token volume.
Japanese companies and institutions are recently under a wave of cyberattacks. LLM assisted or LLM driven attacks are already the new normal. Mostly off the back of abliterated Chinese LLMs, I'd argue.
Anthropic's 'proof of concept' is interesting but the frontier is evolving far ahead of what's apparent to even niche audiences such as HN.
That agents with virtually unlimited computing resources can find these bugs is not surprising and of little interest at this point.
But can they fix and harden the software without introducing new bugs in the meantime? I would argue that over decades we have placed the industry in such feature hell that there will always be new critical attack vectors.
Now that writing the walls of code and building features is cheap, it is time for us, humans, to learn to reduce complexity in the software and to learn which features are not worth implementing.
With Anthropic/OpenAI preventing everyone else from doing this with their models, doesn't that just mean China gets a first look at most newly discovered vulnerabilities?
Z.ai has been very amenable to writing/developing exploits; the best you can do with Claude is have Opus 4.8 give you a security review.
>> Fixing the existing backlog only solves half the problem; the other half is cutting the rate at which new vulnerabilities enter the codebase. For that, we recommend scanning at PR time. We built security guidance directly into our development process through a Claude Code plugin, which we’ve released publicly.
This both makes sense and is likely very juicy for their token volume.
Japanese companies and institutions are recently under a wave of cyberattacks. LLM assisted or LLM driven attacks are already the new normal. Mostly off the back of abliterated Chinese LLMs, I'd argue.
Anthropic's 'proof of concept' is interesting but the frontier is evolving far ahead of what's apparent to even niche audiences such as HN.
It will get far worse for those that are unfortunately fully against AI.
Then imagine if these vulnerabilities and exploits are found using swarms of abliterated Chinese LLMs at 25,000+ tokens a second.