LLMs probably found this multiple times.

The original exploit, and then when the rumors of a big critical patch got out, the people who are leaking the details online probably used an LLM to find the exploit again.

Just revealing that an unpatched exploit exists in $XYZ these days basically guarantees that a bunch of people are going to target $XYZ with LLMs looking for that exploit.

▲

simondotau 6 hours ago | parent [-]

I would have expected there to be a hundred entities running every single model over major code like PHP, and clang, and pretty much any behemoth open source project the world relies on. This is the sort of thing the model makers should be doing as a matter of course, as part of routine testing of their new models.

▲

SyneRyder 4 hours ago | parent | next [-]

Exactly. I thought this is exactly what Anthropic's Project Glasswing was meant to be, and targeted at critical internet infrastructure.

Either Mythos is useless and didn't find this (hint: Opus 5.5 will find this once it knows where to look)... or, they did find it, and this is one of many vulnerabilities they're covering up via "guardrails".

I'll be a lot happier if I wake up tomorrow and find this was found with help from Anthropic (or even OpenAI) but I won't hold my breath.

▲

georgemcbay 6 hours ago | parent | prev [-]

> I would have expected there to be a hundred entities running every single model over major code like PHP, and clang, and pretty much any behemoth open source project the world relies on. This is the sort of thing the model makers should be doing as a matter of course, when they’re testing their new models.

Well, that would be super nice of them.

From a Machiavellian standpoint it may benefit the people with the most powerful models to let some serious RCEs like this PHP one get widely exploited in damaging ways to further their regulatory capture argument that open weight models have to be legally banned and only locked down models with enforced guardrails around usage can be allowed.

	▲	simondotau 2 hours ago \| parent [-]
		> From a Machiavellian standpoint From a marketing standpoint, having the first model to find a bug of this magnitude and severity would be a pretty damn impressive proof of capability. Finding previously unknown, critical vulnerabilities in widely used open-source software could become a gold-standard test of frontier AI competence.