Shafik Yaghmourshafik@hachyderm.io
Apr 8, 2026, 8:14 PMReplies
- Shafik Yaghmourshafik@hachyderm.ioApr 8, 2026, 8:23 PM
I would be amazed if somehow this gets results as good as the best tools + fuzzers combined.
What it does do is level up script kiddies (do we call them that anymore?). A lot of the steps that required real learning can be automated and the output can be crap b/c who cares if it is maintainable?
Challenges like exploiting multiple layers of bugs to get to something really exploitable and actually turning it into a real exploit require real skill, likely not anymore.
My fear is that amount of security flaws in the current LLM tools offers a really nice playground for a worm to spread very quickly. Especially with the agents socializing w/ each other.
I am sure corporate infosec folks are not thrilled and likely have hands tied, well at least until a real exploit happens.
- Shafik Yaghmourshafik@hachyderm.ioApr 8, 2026, 11:13 PM
I will change my answer slightly here.
I was assuming source code scanning to find exploits but if they are instead talking about finding exploits via vulnerability probing via stacking all the existing infosec tooling out there or something similar.
That is 💯 believable they have gotten impressively great results there and I was waiting for that to happen. This was the obvious path that lowers the exploitation barrier but my impression was that they were purposefully avoiding this path b/c the consequences are likely pretty grim.
They could justify it using a MAD model like we did during the Cold War. Once you open that gate though.
- Shafik Yaghmourshafik@hachyderm.ioApr 9, 2026, 12:36 AM
Reading more on this:
https://www.wired.com/story/anthropic-mythos-preview-project-glasswing/
and it indeed looks like they turned it into an elite hacking tool. Well, that was a choice.
The next few years will be interesting exploit wise.
Joe GroffjoeApr 9, 2026, 2:33 AM@shafik as other folks in my replies noted, it might be that there’s an initial wave of low hanging fruit that these models can find, and their efficacy could taper off over time
- Shafik Yaghmourshafik@hachyderm.ioApr 9, 2026, 2:48 AM
Yes but the tails are long here. If we assume organizations step up and catch problems quicker than it should flatten out but not sure that is a good assumption.
The motivation for cracking things is way higher than the motivation for a diverse set of developers to keep on their toes.
We have been writing insecure software for a long time since we knew how to avoid a lot of these issues.
James WidmanJamesWidman@mastodon.socialApr 9, 2026, 5:18 AM