181–188 of 188 posts
Isn’t it rather : we now have a new family of security flaws detector, which find other issues on top of the ones already found by conventional ( human or regular static analyzers ) methods ?
If they supersede all the existing ones , then it’s quite major, and quite a bunch of vendors will disappear …
Earlier quoted context omitted.
This is exactly how I would not recommend AI to be used. “do a thing that would take me a week” can not actually be done in seconds. It will provide results that resemble reality superficially. If you were to pass some module in and ask for finite checks on that, maybe. Despite the claims of agents… treat it more like an intern and you won’t be disappointed. Would you ask an intern to “do a security audit” of an enti…
What is there to loose in trying? Basically, don't trust AI if it says "you program is secure", but if it returns results how you could break it, why not take a look? This is the way I would encourage AI to be used, I prefer such approaches (e.g. general code reviews) than writing software by it.
Earlier quoted context omitted.
But you're not a member of Anthropic's Red Team, with access to a specialist version of Claude.
I don't think that matters at all.
"Find zero-day exploits in this popular software." I haven't tried it I suspect that the guardrails will make a difference.
Earlier quoted context omitted.
Thank you very much for acting as a useful foil and proving my point.
You didn't make a point, and still haven't. You screeched a bunch of buzzphrases sarcastically as if that were equivalent to making a point, which is about par for the course for the level of reasoning (ie. none) shown by people with the position you hold. You seem to take it for granted that just by asserting that LLMs aren't next-token-prediction-programs, that must be factually true, without making any kind of arg…
Earlier quoted context omitted.
I don't think that matters at all.
I think that Anthropic's own version of Claude will give them different results than the ones you get. "Find zero-day exploits in this popular software." I haven't tried it I suspect that the guardrails will make a difference.
Anthropic feels like they are flailing around constantly trying to find something to do. A C compiler that didn't work, a browser that didn't work, and now solving bugs in Firefox.
Earlier quoted context omitted.
I guess it is good when bugs are fixed, but are these real bugs or contrived ones? Is anyone doing quality assessment of the bugs here? I think it was curl that closed its bug bounty program due to AI spam.
The bugs that were issued CVEs (the Anthropic blog post says there were 22) were all real security bugs. The level of AI spam for Firefox security submissions is a lot lower than the curl people have described. I'm not sure why that is. Maybe the size of the code base and the higher bar to submitting issues plays a role.
Further browsers have a much larger surface area for even minor fuzzing bugs. Curl's much smaller surface area is already well fuzzed and tested.
Chrome has better fuzzing and tests too. Firefox has had fewer resources compared to Google ofc, so understable.
Ofc not saying it wasn't good. But given the LLM costs I find it hard believe it was worth it, compared to just better and more innovative fuzzing which would possibly scale better.