hqzhao

4 ms·

1. 1.▲
   by hqzhao 2y ago

   While human researchers might consider this bug trivial, I still feel happy that it can be discovered and patched automatically :)
2. 2.▲
   by hqzhao 2y ago

   I heard that the AIxCC booth prepared the same challenges for the audience to solve manually, but I didn’t check the details. I believe there will be even more cool stuff in next year’s grand final. If you want to get a sense of what to exp
3. 3.▲
   by hqzhao 2y ago

   It's not a critical issue, but it was surprising since we didn’t know that SQLite3 would be one of the challenges before the competition.
4. 4.▲
   by hqzhao 2y ago

   Thanks! We haven't tested it yet. Regarding CTFs, I have some experience. I'm a member of the Tea Deliverers CTF team, and I participated in the DARPA CGC CTF back in 2016 with team b1o0p. There are a few issues that make it chall
5. 5.▲
   by hqzhao 2y ago

   Based on popular pre-trained models like GPT-4, Claude Sonnet, and Gemini 1.5, we've built several agents designed to mimic the behaviors and habits of the experts on our team. Our idea is straightforward: after a decade of auditing co
6. 6.▲
   by hqzhao 2y ago

   It really depends on the target and the quality of the vulnerability. For example, low-quality software on GitHub might not warrant high bug bounties, and that's understandable. However, critical components like KVM, ESXi, WebKit, etc.
7. 7.▲
   by hqzhao 2y ago

   I'm part of the team, and we used LLM agents extensively for smart bug finding and patching. I'm happy to discuss some insights, and share all of the approaches after grand final :)