Post

Like, is the biggest threat to cybersecurity the mere existence of LLMs, or is it the existence of companies like OpenAI with basically unlimited resources and an incentive to create large security incidents essentially as a marketing stunt?

OAI spent the equivalent of ~$20m just on their N-S math paper, just on tokens; not counting wasted effort on other math problems, payroll for the people running this project, etc. How much do we think they're spending to get these cibersecurity results?

It's worth questioning how much of this is real, how much of this is economics (we've never had this scale of incentive pointed at finding common vulnerabilities before), how much of this is just hype. That there's a steady stream of new CVEs all the time has always been the case.

If anyone with access to a frontier model can trivially find critical vulns in something as widespread as PHP, why isn't the internet *already* on its knees?

This is a real claim that is being made, that asking "find vulnerabilities in PHP" into a prompt and letting a frontier model work found the exploit independently. If that's the case, again, how are you reading this? How has the datakrash not happened already? www.linkedin.com/feed/update/...

The obvious answer is that this linkedin post, like all linkedin posts, is lying; that the guy jumped the gun on patching a vuln that was disclosed to him ahead of the embargo and is trying to claim "oh Fable found it for us" to save face. AI hype citogenesis in action.

the AI companies position would be: because we keep spending all this money to find the vulnerabilities first, then tell the maintainers so they can fix it before the people with the less-powerful open models can find them.

indeed, and isn't that very convenient for them and impossible to falsify!