Cybersecurity looks like proof of work now

Post by fragmede » Thu, Apr 16, 2026, 2:35 AM UTC

theptip wrote: post #103

anitil wrote: post #53

Earlier quoted context omitted.

On that latest episode of 'Security Cryptography Whatever' [0] they mention that the time spent on improving the harness (at the moment) end up being outperformed by the strategy of "wait for the next model". I doubt that will continue, but it broke my intuition about how to improve them [0] https://securitycryptographywhatever.com/2026/03/25/ai-bug-f...

It’s a good thing to keep in mind, but LLM + scaffolding is clearly superior. So if you just use vanilla LLMs you will always be behind. I think the important thing is to avoid over-optimizing. Your scaffold, not avoid building one altogether.

Post by argee » Thu, Apr 16, 2026, 3:06 AM UTC

anitil wrote: post #53

somesortofthing wrote: post #7

There's still the question of access to the codebase. By all accounts, the best LLM cyber scanning approaches are really primitive - it's just a bash script that goes through every single file in the codebase and, for each one and runs a "find the vulns here" prompt. The attacker usually has even less access than this - in the beginning, they have network tools, an undocumented API, and maybe some binaries. You can d…

On that latest episode of 'Security Cryptography Whatever' [0] they mention that the time spent on improving the harness (at the moment) end up being outperformed by the strategy of "wait for the next model". I doubt that will continue, but it broke my intuition about how to improve them [0] https://securitycryptographywhatever.com/2026/03/25/ai-bug-f...

Post by noobcoder » Thu, Apr 16, 2026, 3:14 AM UTC

Post by [deleted] » Thu, Apr 16, 2026, 3:23 AM UTC

Post by fragmede » Thu, Apr 16, 2026, 3:29 AM UTC

linkregister wrote: post #49

btown wrote: post #29

Earlier quoted context omitted.

The problem, though, is that this turns "one of our developers was hit by a supply chain attack that never hit prod, we wiped their computer and rotated keys, and it's not like we're a big target for the attacker to make much use of anything they exfiltrated..." into "now our entire source code has been exfiltrated and, even with rudimentary line-by-line scanning, will be automatically audited for privilege escalatio…

This is a great example of vulnerability chains that can be broken by vulnerability scanning by even cheaper open source models. The outcome of a developer getting pwned doesn't have to lead to total catastrophe. Having trivial privilege escalations closed off means an attacker will need to be noisy and set off commodity alerting. The will of the company to implement fixes for the 100 Github dependabot alerts on thei…