Add section on vulnerability research#23
Conversation
| If you are unsure about the security of your setup, start with the default protections. | ||
| Then gradually tune them or disable the parts that are too annoying for your workflow. | ||
|
|
||
| ## Vulnerability Research |
There was a problem hiding this comment.
Please move this to a separate page in expanding horizons
|
|
||
| ## Vulnerability Research | ||
|
|
||
| Before reaching for AI, make sure the basics are covered. |
There was a problem hiding this comment.
This looks to be entirely AI-written, doesn't it? :D you know what I ask about
| For most of 2024 and 2025, AI-assisted vulnerability scanning produced more noise than signal. | ||
| Most tools applied pattern matching dressed up as reasoning, surfacing the same classes of issues that static analysis had already flagged. | ||
|
|
||
| That changed with frontier models. |
There was a problem hiding this comment.
what property of frontier models enabled this change? noun is missing here
| Most tools applied pattern matching dressed up as reasoning, surfacing the same classes of issues that static analysis had already flagged. | ||
|
|
||
| That changed with frontier models. | ||
| <ExternalLink href="https://red.anthropic.com/2026/mythos-preview/" /> documents what Anthropic's latest model found when applied to real codebases: a 27-year-old integer overflow in OpenBSD's TCP stack, a 16-year-old codec bug in FFmpeg that had survived extensive automated fuzzing, and a 17-year-old remote code execution path in FreeBSD's NFS implementation. |
There was a problem hiding this comment.
It's important to mention that all of these bugs could be reproduced with weaker models. Often if they were peepholed (aka they were unable to find the bug when given entire codebase, but they were pretty capable of doing so if tasked to find the bug in the particular function).
I miss this criticism here.
There was a problem hiding this comment.
please editorialize titles of added links so that they flow nicely in text
2 participants
No description provided.