Post #2671175
2026-05-08 02:45 UTC
I clicked through a couple of the bugs they posted and all of the ones I saw at least were single-function bugs (some involved recursion) with some extremely basic mistake patterns
e.g. failing to make a dependent change conditional on whether a function call succeeds, or comparing the wrong pointer out of two
idk what their analysis infra is like but based on the output, I guess the LLM found the simple patterns first and then walked the code backwards to find the triggering condition
Replies (1)
-
@archo@mastodon.gamedev.place 2026-05-08 02:52
walking the code backwards however is something static analysis tools have been able to do for some time so it's not even necessary for an LLM to be involved for that part (at least for static languages) so I would expect that eventually (if not already) that part will be made deterministic, the initial pattern matching could use a smaller and specialized "model" operating with normalized code (removing syntax and spelling from the equation) and only cross-lang exploit gen may still need an LLM