4 ms·
Just commenting for posterity… if this is what it claims to be, I am not looking forward to how it will empower the people who submit bug bounties to us. Histo
by sebmellen 4mo ago
Just commenting for posterity… if this is what it claims to be, I am not looking forward to how it will empower the people who submit bug bounties to us.
Historically they’ve been people from certain identifiable countries (usually developing/poorer countries) using fuzzers with low-quality results.
Now, those same people use the current-day models to good effect, but they still don’t have a true security edge and oftentimes the reports are minor or duplicative.
I wonder if that’s about to deeply change.
- rs_rs_rs_rs_rs 4mo agoCan you use AI to pre-triage the reports too?
- hootz 4mo agoAI reviewing AI submitted bug bounties. We have reached the dead bug bounty program theory.
- rs_rs_rs_rs_rs 4mo ago...what else can you do?
- hootz 4mo agoI guess either that or closing the bug bounty program, but I still believe closing it is worse than automated triage, even though both suck.
- arkwin 4mo agoI've been using Opus 4.6-4.8 in both my own and others' code to look for vulnerabilities, and I've found a few. I am also in the Cyber Verification Program. Fable 5 gives me policy violation errors at the moment. No idea when or if it will be fixed.