| ▲ | nr378 4 hours ago |
| It seems like OpenAI are trying to frame this as if AI did all the work here, but it's not really true given what Calif say (https://calif.io/php2shell/): > How did we find this? > No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now. > There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly. |
|
| ▲ | senordevnyc 3 hours ago | parent | next [-] |
| They literally open by saying Calif used GPT 5.6 Sol, which is a widely available model. Yes, the person driving did more than "find all the bugs", but nowhere does OpenAI imply otherwise. |
| |
| ▲ | burkaman 2 hours ago | parent [-] | | > It highlights how AI can uncover security flaws with internet-scale impact > To our knowledge, frontier AI found these vulnerabilities before attackers did I don't know who/what Calif is and there's no link to them, so if I were only reading this article I would definitely get the impression that "AI did all the work here". | | |
| ▲ | KeplerBoy an hour ago | parent [-] | | Nobody works without any AI these days, most of us have access to the same models and yet we all do and achieve different things. It's a weird time. | | |
|
|
|
| ▲ | Jeep_ 4 hours ago | parent | prev | next [-] |
| Pure marketing, it's getting increasingly hard to separate actual technical feats of agents from marketing pretentious declarations. Such a terrible environment to navigate right now. |
| |
| ▲ | redanddead 4 hours ago | parent | next [-] | | What’s worse is that this is part of a larger strategy of scaring the public to get regulatory capture It’s just gross and manipulative. You have no moat, get over it pAtCh ThE pLaNeT today, tomorrow it's creepy rent-seeking behavior | | |
| ▲ | orangedog 2 hours ago | parent [-] | | Damned if you do, damned if you don't. Do you prefer they not engage in helping finding vulns at all? Do you not think there are parts of the company interested in security and doing it for the sake of that? I feel like taking every action these companies take as part of some larger strategy is kind of conspiracy-minded. | | |
| ▲ | kafrofrite an hour ago | parent | next [-] | | Disclaimer: I work as a sec engineer and part of my job includes finding vulnerabilities. I think the effort is misplaced. We should be exploring ways to make our systems more resilient and I would expect those companies* to focus on that front. Vulnerability research is important, and we should aim to remove as many bugs as we can from our codebases but the pace of software development is increasing and so is the introduction of new bugs. * I would also expect an increase on relevant research regarding novel paradigms of securing systems. | |
| ▲ | redanddead 2 hours ago | parent | prev [-] | | Why didn't OAI go back to non-profit again? Where's the conspiracy. There is no moat. The technology is easily reproducible. Deepseek unwound an entire business model yesterday. | | |
| ▲ | orangedog 2 hours ago | parent [-] | | The conspiracy theory is suggesting this is part of a larger strategy. I'm just saying it's a big enough company with a wide enough range of beliefs that I find it pretty likely that the direct motives for this weren't to enable regulatory capture. But they could be, that's why it's a conspiracy theory. | | |
| ▲ | fn-mote an hour ago | parent | next [-] | | Suppose it goes like this: part of the company clearly benefits from “AI scary” publicity. Other parts of the company want to support the public. The first part of the company backs up the second in internal politics. Do you consider this a conspiracy? Just seems like “good business” to me. It doesn’t seem as clean as you want to make it seem, though. | |
| ▲ | 2 hours ago | parent | prev [-] | | [deleted] |
|
|
|
| |
| ▲ | shimman 4 hours ago | parent | prev | next [-] | | It's not hard tho, the default mode of thinking should be to never trust what a US corporation says. | | |
| ▲ | giantg2 4 hours ago | parent [-] | | Why limit only to the US? | | |
| ▲ | shimman 4 hours ago | parent [-] | | US corporations benefit from US corruption and US imperialism. Hard to not think of a more destructive force currently in the world. | | |
| ▲ | antonvs an hour ago | parent | next [-] | | You’re right overall, but keep in mind that part of the way “US imperialism” works has been to export its corporate style to other countries. This means the infection goes far beyond the US alone. | |
| ▲ | cyanydeez 3 hours ago | parent | prev [-] | | keep in mind, the point of most views is a toddler who lies about stealing a cooking isn't corrupt, because they're a child and can't do anything. The same view point is used for racism, dei, and the rest: it doesn't matter if the poor beggar on the corner hates white people. They don't have any means or methods to act on it. |
|
|
| |
| ▲ | Frieren 4 hours ago | parent | prev | next [-] | | Not marketing. It is a crime related to fraud or securities fraud. | | |
| ▲ | orangedog 4 hours ago | parent [-] | | You're claiming this is securities fraud? | | |
| ▲ | recursive 4 hours ago | parent | next [-] | | Not only that, but everything else is also securities fraud. | |
| ▲ | Frieren 3 hours ago | parent | prev [-] | | What is your argument to say that lying to investors and shareholder is not a crime? It seems a weird position to defend. | | |
| ▲ | orangedog 3 hours ago | parent [-] | | They aren't lying, they are saying their tool was used in the process of finding this bug. Was it not? | | |
| ▲ | esseph 3 hours ago | parent [-] | | With this bug, it was not. See above comments. | | |
| ▲ | orangedog 3 hours ago | parent [-] | | > Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet (opens in a new window) initiative > 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August. I again ask how they are lying? I get if people hate these companies, but blatantly disregarding what is said helps nobody. |
|
|
|
|
| |
| ▲ | alper 3 hours ago | parent | prev [-] | | This isn't a security incident as much as it is a marketing opportunity for all these companies. |
|
|
| ▲ | lukewarm707 3 hours ago | parent | prev | next [-] |
| OpenAI: your misfortune is our PR opportunity |
|
| ▲ | Frieren 4 hours ago | parent | prev | next [-] |
| > OpenAI are trying to frame this as if AI did all the work here CEOs of all big corporations are constantly lying and misleading the public, investors and shareholders. That is a crime. A shame that it is not enforced anymore. |
|
| ▲ | mentalgear 3 hours ago | parent | prev [-] |
| Just more IPO shilling from the scam-man. |
| |
