3 ms·
> Not a POC. An exploit. What's the distinction? A proof of concept is just something that demonstrates that a bug is possible to exploit, by doing so.
by streetfighter64 7mo ago
> Not a POC. An exploit.
What's the distinction? A proof of concept is just something that demonstrates that a bug is possible to exploit, by doing so.
- cushychicken 7mo agoRepeatability and/or an actual negative effect. POC generally means “you can demonstrate unintentional behavior”. “Exploit” means you can gain access or do something malicious. It’s a fine line. Author’s point is that the LLM was able to demonstrate some malfeasance, not just unintended consequence. That’s a big deal considering that actual malicious intent generally requires more knowhow than raw POC.
- tptacek 7mo agoSpecifically: the exploit extracted the admin's credentials from the database. A blind SQLI POC would simply demonstrate the existence of a timing channel based on a pathological input.
- cushychicken 7mo agoOne other commenter asked a decent question - does going lighter (Zig) or harder on memory safety (Rust) confer any meaningful advantages against the phenomenon you describe?