Post

The greater ability to automate exploits will definitely move the bar for "long hanging fruit". Exploit chains that would've been infeasible to follow through on, the ability to automate search for weird interactions, etc. We're going to need to move to formal systems and it will be painful

well isn't the point of the shift left doing the above as part of development?

This is helpful. Do you have suggestions for what regulations or policy would be most useful, or suggestions for who might?

it seems the computers are doing unspeakable things to each other by themselves

Fascinating

The 'AI finds bugs, humans triage' framing rings true. The skill shift is real though — juniors who can run an agent fleet and spot hallucinated vulns are already out-finding manual hunters in shallow code. Depth is where humans still win.

Six months later this thesis holds up — the value shifted from finding the bug to proving exploitability and impact. The researchers who adapted are doing AI-assisted triage at machine speed; the ones who didn't are drowning in slop.

This is amazing. I just took Nicholas Carlini's prompts and fed our public-internet facing code into it and got back a bunch of valid vulnerabilities along with reproductions.