Post #1253980

2026-04-09 17:49 UTC

@jenniferplusplus while I agree with the "AI companies are mostly full of shit" part, this would be the first kind of announcement like this I am taking semi-seriously. Here's what's been happening the last couple of months, and this is with _current_ models. There are step functions at play, and I think the step function from "at least some skill needed to wield an LLM to find security issues" to "everybody with a $200 can exploit every OS/browser out there" should be considered very carefully. Nicholas Carlini saying he found more bugs in 2 weeks than in his entire career with Mythos is not something I can dismiss. Or daniel stenberg, certainly someone with actual authority and experience compared to me showing the current situation: https://mastodon.social/@bagder/116373716541500315 https://mastodon.social/@bagder/116362046377975050

Replies (1)

@jenniferplusplus@hachyderm.io 2026-04-09 18:04

@mnl I'm not sure what I'm supposed to do with this. It feels like it's meant to dispute something I'm saying, but this is the same dynamic. The actual cost of operating these tools is 50-100x greater than the vendors are charging, which the vendors are doing in the hope that it eventually becomes an inextricable part of all work, completely eliminating labor as a social power. Your hypothetical looks very different when it's "everybody with $20,000 (per month) can exploit every browser/os out there." Which is actually true now. It was true 6 months ago. It's been true for as long as we've had software that you could identify vulnerabilities in whatever software you wanted by paying a generous salary to full time researchers. That's not what capital chose to do. And it bothers me that everyone is just adopting the capitalist framing on every goddamn word these companies spit out, as long as one of those words is AI

Open ##1253981