Automated vulnerability discovery via LLM.

Anyone care to share which models and which prompts actually lead to finding these kinds of vulnerabilities? Or the narrowing-down workflow that can get an LLM to discover them? Surely just telling claude "Find all vulnerabilities in this project LOL" isn't enough? I hope?

The Anthropic researchers have said their flow is as simple as:

1. Pick a file to seed as a starting place.

2. Ask the LLM (in an agent harness) to find a vulnerability by starting there.

3. If it claims to have found something, ask another one to create an exploit/verify it/prove it or whatever.

4. If both conclude there is a vuln, then with the latest models you almost certainly found something real.

Just run it against every file in a repo, or select a subset, or have an LLM select files with a simple "what X files look likely to have vulns?".

So basically yes, it is that simple. It's just a matter of having the money to pay for the tokens.

Thanks for the reply. Pretty remarkable.

Everyone was talking about how Mythos was overblown marketing, and while it may be, they missed the forest for the trees. Capabilities have been escalating for a year now and we're at the point of widespread impact. I don't suspect we'll see a slowdown for a long time.

I agree. It is not like Mythos or other LLMs are insanely smart/superhuman. Many of these vulnerabilities could be discovered fairly easily by trained human experts as well. The problem is more that it requires an insane amount of attention and time of highly-paid experts to shake out these issues vs. an LLM that never gets tired and can analyze a large amount of code at low cost.

Linus' law was wrong because there were never enough (qualified) eyeballs to check the code. LLMs provide an ample supply of eyeballs (though it's not a benefit to open source, since proprietary developers can use the same LLMs).

Same applies to them being good enough to program, but many are so focused on source code generation that they don't get the whole picture.

Thanks to agents and tool calling, there are now business cases that can be fully described by AI tooling, the next step in microservices, serverless and what not.

Naturally with a much smaller team than what was required previously.

> Nit: a gourmand is the opposite of a gourmet

> The original usage of Gourmand was

Your original “well actually” is incorrect by your own admission. The correct statement is “a gourmand [was] [in some sense] the opposite of a gourmet”.

Not as punchy. I can see why you exaggerated, but as a fellow pedant I can’t approve of the misinformation.

Starting a sentence with “How” is standard English, too.

Much of clickbait is standard English. HN takes a policy of applying editorial discretion to headlines, which makes the site more valuable.

Eager to make bank off the back of civilisation, too? My IT colleagues continue to impress!

Civilization will be effected the same way anyway, why not make a buck of it? But you wouldn't be able to anyway because some quant's ml model would have already sucked every dollar out of the opportunity two milliseconds after the insider executed the trade

Psychopaths and sociopaths come from all types of backgrounds. One things for sure, they all tend to gravitate towards power and exploitation of people without remorse. C suite and founders are far from immune from this...

> far from immune from this...

Its a pre-requisite for the job

> C suite and founders

You missed "VC backed" in front of "founders". Most founders are good people.

> His response makes me believe …

I’d pay more attention to his behavior.

The country is descending into fascism. If you’ve previous endulged in the politics of “I don’t care about politics”, it’s time to stop and look around you.

The problem is that you decided the correct place for your “version of his post” was in the comments to his version of his post. This rhetorically implies you’re offering your version as an alternative to his, and it explicitly sets up your version as a comment on his version.

And then you claim your version is only about you. Why post it as a reply, if that’s true? It would be off topic. But it isn’t off topic; because actually you are talking about OP in addition to yourself.

This doesn’t explain the cover (seemingly not used in the final collection) with a hallucinated map on it. Maybe they only used generative art for mockups, but they did use it on a cover design.

…while not changing anything about our behavior, you mean. Because we were never ignorant of how to do better; we just couldn’t accept even any inconvenience, any obstacle to our “growth”.

I'm well aware! Not only are we unable to change our behaviour we in fact have the hubris to imagine that if we could only use our technology to communicate with the whales that it would be enough to say

> "Don't go to these places—even though you want to, even though your family has been breeding there for generations—because that's our special whale hunting area"

And that their behaviour would change for us, that their response would simply be:

> "No worries, thanks for the heads up! Sorry for getting in the way of your harpoons"

Not at the pace of change we’ve chosen to accept, no.