Login
You're viewing the discuss.systems public feed.
  • Team KeePassXCkeepassxc@fosstodon.org
    May 11, 2026, 8:45 AM

    RE: mastodon.social/@bagder/116554

    "All modern AI models are good at this now. Anyone with time and some experimental spirits can find security problems now. The high quality chaos is real."

    Second that. The number of confidential security reports for KeePassXC has also gone up (though nothing major yet). Those AI reports used to be slop, but they are now mostly legitimate . We don't know which models are being used by the reporters, but occasionally, we get the same things reported multiple times within the span of just days.

    💬 2🔄 47⭐ 55

Replies

  • Dźwiedziudzwiedziu@mastodon.social
    May 11, 2026, 8:54 AM

    @keepassxc
    > Those AI reports used to be slop, but they are now mostly legitimate.

    1 in 5 doesn't look as “mostly legitimate”.

    To drive the point further, from the quoted blog post:
    > The report concluded it found five “Confirmed security vulnerabilities”. I think using the term confirmed is a little amusing when the AI says it confidently by itself. Yes, the AI thinks they are confirmed, but the curl security team has a slightly different take.

    »

    💬 2🔄 0⭐ 4
  • 💬 0🔄 0⭐ 0
  • Team KeePassXCkeepassxc@fosstodon.org
    May 11, 2026, 8:55 AM

    @dzwiedziu The reports we get these days are mostly legitimate now (not all, but most). Legitimate doesn't necessarily mean "high impact".

    💬 0🔄 0⭐ 3
  • 💬 1🔄 0⭐ 1
  • Team KeePassXCkeepassxc@fosstodon.org
    May 11, 2026, 10:21 AM

    @Chronocide We didn’t receive that many before, so unclear. They are helpful in the sense that some issue was found that people previously missed. Most are low-hanging fruit like hypothetical integer overflows and mismatches between code and documentation etc.

    💬 1🔄 0⭐ 2
  • 💬 0🔄 0⭐ 4
  • bingusBongusbingusBongus@mas.to
    May 11, 2026, 6:29 PM

    @Chronocide

    @keepassxc
    this is more the curl dudes experience, but quoting from his article:
    "But allow me to highlight and reiterate what I have said before: AI powered code analyzers are significantly better at finding security flaws and mistakes in source code than any traditional code analyzers did in the past. All modern AI models are good at this now. Anyone with time and some experimental spirits can find security problems now. The high quality chaos is real."

    💬 0🔄 0⭐ 1