Post #1253940

2026-04-09 01:04 UTC

@jenniferplusplus I seriously doubt this is smoke and mirrors, recent models have improved significantly for cybersec and the industry is noticing: https://mastodon.social/@bagder/116336957584445742 https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_kernel/ The industry consensus seems to be that there's going to be a torrent of vulnerabilities being found in all sorts of software, and they're not prepared to handle the blast radius. It's not surprising that Anthropic wants to give a select few a head start to tackle them. It would be nice if their token fund was open to all OSS projects to apply. I'm also pressing "X doubt" that you spend months coordinating between AWS, Apple, Microsoft, Google, and the Linux Foundation to organise this just because your tool's code leaked online.

Replies (6)

@mirth@mastodon.sdf.org 2026-04-09 02:11

@budududuroiu @jenniferplusplus I wouldn't give Anthropic's motives a lot of credit here but LLMs do make bug hunting much easier.

Open ##1253941
@dngrs@chaos.social 2026-04-09 02:12

@budududuroiu @jenniferplusplus some people have published numbers or noticed "a significant increase in quality" but none of these things bear any scientific rigor. My guess is that the one huge trick anthropic pulled was merely a bigger context window. Sure, that tends to give more context-related (not "true" or "accurate") results (duh!) but it's hardly revolutionary. LLMs are still statistical models doing fancy autocomplete & they know nothing about the world, I'll hold my breath

Open ##1253953
@jenniferplusplus@hachyderm.io 2026-04-09 02:14

@budududuroiu the same people would tell you the "industry consensus" among the rest of tech is that chatbots made programming dramatically more productive. The reality is that they mostly automate the creation of those same bugs and vulnerabilities So, you know Maybe wake me up when they're organizing this thing with someone who's not in the same trillion dollar hole as them

Open ##1253960
@the_decryptor@gts.flawlesscowboy.xyz 2026-04-09 03:11

@budududuroiu @jenniferplusplus I think it's more likely they're just throwing a ton of compute at this stuff and are using the LLMs as a frontend to existing code analysis tools. Similar to Google running fuzzers over every FOSS app and library they used and dumping the results on maintainers to fix. Economies of scale help here.

Open ##1253965
@androcat@toot.cat 2026-04-09 06:49

@budududuroiu Keep chugging that flavor aid.

Open ##1253967
@Sempf@infosec.exchange 2026-04-09 14:59

@budududuroiu @jenniferplusplus Let's talk about JavaScript. Have you ever looked at your browser's developer console? On any major website on the planet, there are 8 trillion errors in every one. Two-thirds of them are vulnerabilities, but none of them are exploitable or matter for anything at all. That is what is being found. Those kinds of errors I've been reviewing, all the ones Daniel's been reviewing too, and I'm seeing it over and over. "Yes, okay, technically that is the buffer overrun, but it doesn't matter because you can't ever get to it!"

Open ##1253968