4 ms·
There is going to be a flurry of this sort of stuff as the AIs get smart enough to find them. It will naturally die down as the legitimate ones are fixed. Yes,
by drob518 4mo ago
There is going to be a flurry of this sort of stuff as the AIs get smart enough to find them. It will naturally die down as the legitimate ones are fixed. Yes, there will always be some level of this, but I’d expect it to be low and the exploits found to be increasingly complex. This is a time of transition.
- jMyles 4mo ago> It will naturally die down as the legitimate ones are fixed. Seems like we're already in the middle of this phase, but rather than dying down, the 'reports' have just gotten more noisy and obtuse, making it more difficult to establish the actual degree of threat / attack vector.
- justacrow 4mo agoAnd if you are a state agency who'd like to keep the undisclosed zero-days you rely on secret, spamming maintainers with reports makes sense. As a bonus if you find any actual zero-days in your mass-generated ones you don't report it and get a new one to play with.
- alwa 4mo agoI mean. Makes sense until adversary states start walking through the same doors you’re using. At which point you might regret that maintainers are too flooded to deal with it. Assuming, of course, said state agency is operating under sufficiently strategic governance and management…
- utopiah 4mo ago> a flurry of this sort of stuff as the AIs get smart enough to find them. I really think this characterization is misleading. It's not "getting smart", only more tailored toward a specific usage, better curated dataset, better harness, better prompts, better labeling of results, documentation of failures and success, etc. The outcome is (hopefully) overall better but this anthropomorphized wording makes it sound like AI itself is somehow changing or evolving. No, both academia doing fundamental research, industry making it available commercially, and finally security researchers making the entire tooling and process packaged as a service are actively shaping it to make it better. There is no "it".
- drob518 4mo agoYes, of course. I’m definitely anthropomorphizing as a shorthand. I’m the first one to say that these models are just a lot of matrix math.
- handoflixue 4mo agoDo you have a definition of "smart" such that there is something an AI could do to prove itself intelligent? Or are you just defining "fast" as something only horses can do, and considering that a useful insight about cars?
- slopinthebag 4mo agoA future AI may be intelligent, but LLMs are clearly not. They have no agency, no ability to reason, and no world model. The most effective way to use them is to treat them as next token prediction machines, because that’s what they are. edit: downvotes but no rebuttals. feel free to show me where the agency, reasoning from first principles, world model etc exists. or you can ask an llm and they'll tell you they don't have those.
- deleted 4mo ago[deleted]
- roelljr 4mo ago[flagged]
- efreak 4mo agoLong-term memory, for one. (reliving your entire life every time you do an action isn't memory). Creativity in new areas without training. Children at school are capable of "discovering" math solutions/methods that are known to others but hasn't been taught to them. There's nothing intelligent about a math processor, even if it's automated.
- handoflixue 4mo ago
- juleiie 4mo agoHonestly execution complexity is over time becoming a lower and lower barrier too.
- yieldcrv 4mo ago> It will naturally die down as the legitimate ones are fixed. Every software update introduces and reintroduces them
- drob518 4mo agoPerhaps, but as the AI analysis becomes part of the release process (or even the CI process as prices fall), you’d expect those new issues to be caught before release and fixed. We’re seeing them caught post-release for now because the code is older than the AIs, so we’re catching up.
- necovek 4mo agoI actually do not expect it to die down: as legitimate ones get fixed, LLM-based tools will continue finding other unfixed non-issues repeatedly, and overeager "researchers" will continue reporting them.
- blazespin 4mo agoYeah, I am seeing this as well, especially as people use AI to code review stuff more so this sort of thing slips through. On one very large project I am looking at, it's already becoming harder to find issues. These people whinging about slop don't realize everything that doesn't come from a credible source gets ignored. Credible people are using AI and once these issues are fixed, it will die down. The threat of AI zero days will persist though, but they will be much more expensive and subtle to find.