today at 10:53 PM
There's an anecdote about curl, but I'm not sure if there's enough in here to draw conclusions from. 20% of vulnerabilities have been made public, and many of those are marked as "withdrawn" or "duplicates". However, it's unclear whether the remaining 80% have not been made public because they're not fixed or real. In other words, this is analysis of survivors (public); not much can be said about those still under embargo.
today at 11:27 PM
And on top of that, it's a bit negative. How many millions of dollars is one perfect-10 scoring CVSS finding, total destruction style RCE, found in curl worth? Considering how many people use it.
today at 11:45 PM
It's worth zero millions dollars to curl. It might be worth something to attackers, but "wide use" is not the same as "the ability to compromise everyone" because most of the time, curl isn't used to automatically fetch untrusted URLs in a way that's controlled by the attacker from an environment they care about. It's worth much, much less than a 0-day in an iPhone or PHP.
By extension, if a vuln is worth something to attackers, it's probably also worth some fraction of it to defenders, but if you're an interesting target, your defense simply can't be based on the ability to find about every single software defect ahead of the time. You need layers.
today at 10:59 PM
It is bad if this points to a general pattern of AI being better at finding than fixing vulnerabilities. The larger that ratio, the harder to secure all the things. The current stat from this experiment is 37,966 to 217. Lots of false positives, but not enough to change the big picture. I hope they didn't apply equivalent tokens to both sides, or AI may be better at demolition than construction.
today at 11:40 PM
So far the trend is pointing to AI being better at finding problems than designing software to avoid them.
Which I'm fine with really, but it means you need to be very careful letting it iterate on code until it finds no problems.
today at 11:32 PM
It'll never scew to far of as long as defence is a RL target. Better red team just means the blue team has stronger target environmenta to RL for.
today at 10:58 PM
> Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been marked fixed.
So the article is making a sweeping statement based on the 19.4% of publicly disclosed CVEs?
That statistic suggests the opposite. I'm sure government is aware of many back doors they keep secret and prefer them to remain secret.
today at 11:01 PM
"public" here has nothing to do with government holding on to vulns. it's about landing fixes and coordinating complicated / impactful findings
today at 11:21 PM
Does the author expect that every company using Glasswing/AI is going to credit the AI directly? I would not expect Microsoft or Cisco to credit Anthropic if one of their internal teams uses AI to discover a CVE in their code.
today at 10:59 PM
Very interesting that the conclusion of the article is so tightly aligned with the VulnCheck's business model! It's almost as if this is just a thinly veiled advertisement...
> The CVEs are a sliver of this year's total, almost none are being exploited, fixes have stalled while duplicates and withdrawals pile up, and the triage burden is shifting onto the open source maintainers Glasswing promised to help. The receipts keep coming in. They still don't reconcile.
> VulnCheck is helping organizations not just to solve the vulnerability prioritization challenge - we’re working to help equip any product manager, CSIRT/PSIRT or SecOps team and Threat Hunting team to get faster and more accurate with infinite efficiency using VulnCheck solutions.
today at 10:51 PM
I think the most obvious chicken little sign has been that we've had no catastrophic exploits in the past year due these findings.
Sure LLMs have helped reduce the attack surface and we patch things faster too, but I was really expected a few more Supermarket-level bangers.
today at 11:11 PM
There was that PHP thing, as well as *sshole, and how do we know the supermarket attackers didn't use AI?
today at 11:15 PM
But PHP thing was a lot of drama over something that was not super large easy to exploit hole. Just a normal "have to patch it and bye" medium kind issue.
today at 11:36 PM
But imagine the potential fallout if so many services didn’t get so scared that they preemptively took themselves offline.
Apply sarcasm or not based on sleep deprivation.
today at 11:18 PM
We've had catastrophic vulnerabilities revealed every other day for months, what are you talking about?
today at 11:39 PM
Vulnerabilities and exploits are different things.
today at 11:42 PM
You mean like Notion being breached, refrigerators being turned off, that kind of thing?
today at 11:45 PM
Those are exploits. They are different from vulnerabilities.
today at 11:20 PM
[dead]