Apr 8, 2026, 7:23 PM@tef @joe Yeah as neural networks are generally somewhat effective at recognition and classification in a way they aren't with generation, I'm willing to potentially believe this could even find errors in pure code inspection. Problem: linters of such type tend to have a massive false positive rate. Which might be why they're not productizing this, because finding useful exploits winds up wading through *tons* of nonsense that external customers wouldn't put up with
Apr 8, 2026, 7:33 PM@whitequark @tef @joe Additional possibilities:
- They simply hired some really good security researchers to do a Project Zero kinda thing and the secret AI model is essentially incidental.
- They are about to file a large number of low-quality security bugs on items which turn out to be not practically exploitable, things which could have been found with existing tools, or both
Hard to say right now
Apr 8, 2026, 7:39 PM@mcc @whitequark @tef @joe from what I've seen on that front the participants largely fall into three categories: top-1% bug hunters who are there for the payouts, a few security companies who are keen to engage either for marketing or because leadership is personally invested in AI, and AI firms who want to show off their products.
the somewhat unsurprising result is that the pro bug hunters find very shiny bugs, the security companies find some good bugs, and the AI firms report lots of FPs.
Apr 8, 2026, 7:42 PM@mcc @whitequark @tef @joe AI stuff is involved in the process for all parties, and I can't really say how much it aids the bug hunting in those specific contexts, but I think it does make it quite clear that if there is an uplift in bug hunting capability it is a minor factor compared to the security experience and skill of the person driving it.
Apr 8, 2026, 9:33 PM@mcc @whitequark @tef @joe it definitely finds security bugs. There is a large wave of good findings hitting everyone right now (along with a bunch of trash reports, but this can be improved by tightening reporting processes). However, the things that make the news the most, like the FreeBSD kernel exploit chain, are not actually that impressive. maybe impressive for what a computer can do semi-autonomously, but not impressive or representative of exploitation on platforms that have invested in security. They had a 20-gadget ROP chain to allocate a RWX mapping in a kernel with non-functional stack cookies and no ASLR, exploiting a security bug that sat there for 17 years. the only part of this that would make the news if a human wrote it was that the bug sat there for 17 years