Post #2061394

amongst bugs this year, i found two bugs in particular that LLMs are just totally failing at finding yet on the surface are super easy. 1 is a critical rce in android and also a high sev persistence chain with it. both resulted from manual code review, no fuzzing (android is so heavily fuzzed anyways) most of my methodology atm is looking for logic bugs in trust boundaries. ones with big topology. for these bugs I been testing opus 4.7 + gpty in finding it, opus has been running on auto mode (we have a *cyber* approved account) for hours and still not caught it. neither is picking it up. the bug is clear if you read the code and understand the context of the component, but the agent just fails to understand the context or topology. i can't see how the hype around mythos solves this. it feels like an architecture & compression issue. ultimately llms think in lists and have a small context window, attackers don't. we think in graphs and control flow. what they need to be effective is triage compression and graphing, which a human can do with enough experience. they need a map of the territory at a scale that fits in their context window. till that changes my view on LLMs in vuln research isn't changing.