Post

Like, is the biggest threat to cybersecurity the mere existence of LLMs, or is it the existence of companies like OpenAI with basically unlimited resources and an incentive to create large security incidents essentially as a marketing stunt?

OAI spent the equivalent of ~$20m just on their N-S math paper, just on tokens; not counting wasted effort on other math problems, payroll for the people running this project, etc. How much do we think they're spending to get these cibersecurity results?

And these tools have been available for a while now, and we keep seeing these big CVEs, we see dodgy disclosures from AI companies, but what we haven't seen has been actual real-world mass exploitation that no one is prepared for. Is this just because it hasn't happened yet?

If anyone with access to a frontier model can trivially find critical vulns in something as widespread as PHP, why isn't the internet *already* on its knees?

This is a real claim that is being made, that asking "find vulnerabilities in PHP" into a prompt and letting a frontier model work found the exploit independently. If that's the case, again, how are you reading this? How has the datakrash not happened already? www.linkedin.com/feed/update/...

the AI companies position would be: because we keep spending all this money to find the vulnerabilities first, then tell the maintainers so they can fix it before the people with the less-powerful open models can find them.

indeed, and isn't that very convenient for them and impossible to falsify!