Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I used o3 to find a remote zeroday in the Linux SMB implementation

sean.heelan.io

Post reply on HN
Print view View original

151–160 of 232 posts

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#151

Post by resiros »

I think an approach like AlphaEvolve is very likely to work well for this space.

You've got all the elements for a successful optimization algorithm: 1) A fast and good enough sampling function + 2) a fairly good energy function.

For 1) this post shows that LLMs (even unoptimized) are quite good at sampling candidate vulnerabilities in large code bases. A 1% accuracy rate isn't bad at all, and they can be made quite fast (at least very parallelizable).

For 2) theoretically you can test any exploit easily and programmatically determine if it works. The main challenge is getting the energy function to provide gradient—some signal when you're close to finding a vulnerability/exploit.

I expect we'll see such a system within the next 12 months (or maybe not, since it's the kind of system that many lettered agencies would be very interested in).

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#152

Post by geraneum »

This has become a common recurrence recently.

Have a problem with clear definition and evaluation function. Let LLM reduce the size of solution space. LLMs are very good at pattern reconstruction, and if the solution has a similar pattern to what was known before, it can work very well.

In this case the problem is a specific type of security vulnerability and the evaluator is the expert. This is similar in spirit to other recent endeavors where LLMs are used in genetic optimization; on a different scale.

Here’s an interesting read on “Mathematical discoveries from program search with large language models” which was I believe was also featured in HN the past:

https://www.nature.com/articles/s41586-023-06924-6

One small note, concluding that the LLM is “reasoning” about code just _based on this experiment_ is bit of a stretch IMHO.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#153

Post by lyu07282 »

stonepresto wrote: post #147

I know there were at least a few kernel devs who "validated" this bug, but did anyone actually build a PoC and test it? It's such a critical piece of the process yet a proof of concept is completely omitted? If you don't have a PoC, you don't know what sort of hiccups would come along the way and therefore can't determine exploitability or impact. At least the author avoided calling it an RCE without validation. But…

Are you saying you want PoCs that trigger a crash from the use-after-free or you would only be satisfied by full on RCE PoCs?

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#154

Post by dotancohen »

p0w3n3d wrote: post #57
kweingar wrote: post #41

Earlier quoted context omitted.

How do we benchmark these different methodologies? It all seems like vibes-based incantations. "You are an expert at finding vulnerabilities." "Please report only real vulnerabilities, not any false positives." Organizing things with made-up HTML tags because the models seem to like that for some reason. Where does engineering come into it?

Listen to a video made by Karpathy about LLM, he explains why made up html tags work. It's to help the tokenizer

I recall this even being in the Anthropic documentation.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#155

Post by dotancohen »

dotancohen wrote: post #154
p0w3n3d wrote: post #57

Earlier quoted context omitted.

Listen to a video made by Karpathy about LLM, he explains why made up html tags work. It's to help the tokenizer

I recall this even being in the Anthropic documentation.

Here, found it:

  > Use XML tags to structure your prompts

  > There are no canonical “best” XML tags that Claude has been trained with in particular, although we recommend that your tag names make sense with the information they surround.
https://docs.anthropic.com/en/docs/build-with-claude/prompt-...

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#156

Post by rcarmo »

nxobject wrote: post #33

A small thing, but I found the author's project-organization practices useful – creating individual .prompt files for system prompt, background information, and auxiliary instructions [1], and then running it through `llm`. It reveals how good LLM use, like any other engineering tool, requires good engineering thinking – methodical, and oriented around thoughtful specifications that balance design constraints – for b…

It’s all about being organized: https://taoofmac.com/space/blog/2025/05/13/2230

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#157

Post by gizmodo59 »

dieortin wrote: post #148
gizmodo59 wrote: post #50

Earlier quoted context omitted.

Having tried both I’d say o3 is in a league of it’s own compared to 3.7 or even Gemini 2.5 pro. The benchmarks may show not a lot of gain but that matters a lot when the task is very complex. What’s surprising is that they announced it last November and only now it’s released a month back now? (I’m guessing lots of safety took time but no idea). Can’t wait for o4!

All your content threads from the past months consist on you saying how much better OpenAI products are than the competition, so that doesn’t inspire a ton of trust.

Because in my use cases they are? Coding and math, science research are my primary use cases and codex with o3 and o3 consistently outperforms others in complex tasks for me. I can’t say a model is better just to appeal to HN. If another model is as good as o3 id use that in a second.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#158

Post by 0points »

nindalf wrote: post #44
kweingar wrote: post #41

Earlier quoted context omitted.

How do we benchmark these different methodologies? It all seems like vibes-based incantations. "You are an expert at finding vulnerabilities." "Please report only real vulnerabilities, not any false positives." Organizing things with made-up HTML tags because the models seem to like that for some reason. Where does engineering come into it?

The author is up front about the limitations of their prompt. They say > In fact my entire system prompt is speculative in that I haven’t ran a sufficient number of evaluations to determine if it helps or hinders, so consider it equivalent to me saying a prayer, rather than anything resembling science or engineering. Once I have ran those evaluations I’ll let you know.

Author seems to downplay their own expertise and attribute it to the LLM, while at the same time admitting he's vibe prompting the LLM and dismissing wrong results while hyping the ones that happen to work out for him.

This seems more like wishful thinking and fringe stuff than CS.

Re: I used o3 to find a remote zeroday in the Linux SMB implementation

#159

Post by bandrami »

jp0001 wrote: post #149

We followed a very similar approach at work, created a test harness and tested all the models available in AWS bedrock and the OpenAI. We created our own code challenges not available on the Internet for training with vulnerable and non-vulnerable inline snippets and more contextual multi-file bugs. We also used 100 tests per challenge - I wanted to do 1000 test per challenge but realized that these models are not ev…

The blinders give you a problem in that a lot of security issues aren't at a single point in the code but at where two remote points in the code interact.
Post reply on HN