| ▲ | simondotau 6 hours ago |
| Once the dust has settled, it would be interesting to give LLMs the pre-patch source code and see whether any of them can identify this chain of vulnerabilities. Even if they can't identify the full chain, can they at least spot one of the constituent bugs and recognise its seriousness? If they can't, why not? If they can, why haven't they already? |
|
| ▲ | afdbcreid 5 hours ago | parent | next [-] |
| If you tell them where the problem is (even rough code area) - I'm 99% sure they can, and have. If you only tell them to find issues in PHP - the strongest models probably still can, although they might find different issues ;) |
|
| ▲ | marcins 6 hours ago | parent | prev | next [-] |
| I’d hazard a guess that’s how the bug was found in the first place? |
| |
| ▲ | georgemcbay 6 hours ago | parent [-] | | LLMs probably found this multiple times. The original exploit, and then when the rumors of a big critical patch got out, the people who are leaking the details online probably used an LLM to find the exploit again. Just revealing that an unpatched exploit exists in $XYZ these days basically guarantees that a bunch of people are going to target $XYZ with LLMs looking for that exploit. | | |
| ▲ | simondotau 6 hours ago | parent [-] | | I would have expected there to be a hundred entities running every single model over major code like PHP, and clang, and pretty much any behemoth open source project the world relies on. This is the sort of thing the model makers should be doing as a matter of course, as part of routine testing of their new models. | | |
| ▲ | SyneRyder 4 hours ago | parent | next [-] | | Exactly. I thought this is exactly what Anthropic's Project Glasswing was meant to be, and targeted at critical internet infrastructure. Either Mythos is useless and didn't find this (hint: Opus 5.5 will find this once it knows where to look)... or, they did find it, and this is one of many vulnerabilities they're covering up via "guardrails". I'll be a lot happier if I wake up tomorrow and find this was found with help from Anthropic (or even OpenAI) but I won't hold my breath. | |
| ▲ | georgemcbay 5 hours ago | parent | prev [-] | | > I would have expected there to be a hundred entities running every single model over major code like PHP, and clang, and pretty much any behemoth open source project the world relies on. This is the sort of thing the model makers should be doing as a matter of course, when they’re testing their new models. Well, that would be super nice of them. From a Machiavellian standpoint it may benefit the people with the most powerful models to let some serious RCEs like this PHP one get widely exploited in damaging ways to further their regulatory capture argument that open weight models have to be legally banned and only locked down models with enforced guardrails around usage can be allowed. | | |
| ▲ | simondotau 2 hours ago | parent [-] | | > From a Machiavellian standpoint From a marketing standpoint, having the first model to find a bug of this magnitude and severity would be a pretty damn impressive proof of capability. Finding previously unknown, critical vulnerabilities in widely used open-source software could become a gold-standard test of frontier AI competence. |
|
|
|
|
|
| ▲ | shepherdjerred 6 hours ago | parent | prev [-] |
| I would be astounded if labs were not already fine tuning on known vulnerabilities for their cyber models |
| |
