But it's not "node2shell". It's a normal memory corruption that's blocked by ASLR. It's not easy to exploit. You should fix it, yes. But using the "blah2shell" terminology is misleading.

It's misleading because it tells people that it can be trivially exploited. It cannot, unless you disable ASLR and compile without PIE.

OpenAI and the other ghouls want you to think LLMs finding all kinds of critical bugs that are trivial to exploit. They want you to think there's no other way to find them.

That's just not true.

I looked at the code, and you know the first thing I noticed? A fuzzer. Google fuzzes their code. OpenAI wrote their press release very cleverly so that it could be misinterpreted as them finding the initial bug, as others have reported, but this could have been (and probably was) found by the existing fuzzer.