Posted by nr378 7 hours ago
So how many tokens can I put you down for.
1. OpenAI started the current AI cycle
2. That cycle has exposed exponentially more security vulnerabilities due to agentic coding
3. OpenAI is rushing as fast as they can to reach the singularity even while acknowledging that they lack the ability to ensure reasonable safety.
4. They launch an initiative to “address” the security vulnerabilities by using their coding tools.
Am I missing something? There is a broad range of motives and responses.
Then, someone releases a pick that works for many more locks humans couldn't pick.
And says: You can't stop the progress. Now pay us to upgrade your locks (no-no, they won't be doctored to fit our next-gen picks, trust us!)
I don't use these models much I just don't like unfair criticism.
> In another thread when I suggested they lied to investors and that constitutes securities fraud you questioned it in an overly dismissive manner.
I'm confused, are you posting under two identities?
The user Frieren claimed that this post constituted securities fraud. To which I responded: "You're claiming this is securities fraud?"
Is that dismissive? It was a genuine question, I don't get how it's even accurate say that they are lying in the post and I especially don't get how it is securities fraud.
Your post doesn't have anything to do with the blogpost. Once again, I'm not against criticism just unfair/weak criticism. I don't think it helps anything.
I am not posting from two profiles. I looked at your prior comments and saw you had responded to me or someone I was debating elsewhere.
I assure you this is perfectly formal, and for your… “safety”.
similarly OpenAI was born out of the idea that the tech will exist and that they should be the oned to decide how it exists instead of other bad guys
I think if you do something you did it, imagining another bad guy doing it is not a great defense.
Is the company selling a magical code generation machine really asking how it can backport a fix to an older version of the same software?
Is this for real?
it’s a quite simple matter to fix a bug once it’s discovered, but how to deploy and where to deploy it when it affects a supply chain?
here’s an example: you can submit a vuln at a downstream dep and they can tell you it should be patched upstream. what should you do? open an issue upstream? maybe, probably not, probably the solution is to contact all downstream deps in order to get them to migrate dep or patch, because you just reported a vuln and they shrugged it off
> How did we find this?
> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.
> There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.
> To our knowledge, frontier AI found these vulnerabilities before attackers did
I don't know who/what Calif is and there's no link to them, so if I were only reading this article I would definitely get the impression that "AI did all the work here".
i still do. i might be the last one.
It’s just gross and manipulative. You have no moat, get over it
pAtCh ThE pLaNeT today, tomorrow it's creepy rent-seeking behavior
I feel like taking every action these companies take as part of some larger strategy is kind of conspiracy-minded.
I think the effort is misplaced. We should be exploring ways to make our systems more resilient and I would expect those companies* to focus on that front. Vulnerability research is important, and we should aim to remove as many bugs as we can from our codebases but the pace of software development is increasing and so is the introduction of new bugs.
* I would also expect an increase on relevant research regarding novel paradigms of securing systems.
Where's the conspiracy. There is no moat. The technology is easily reproducible. Deepseek unwound an entire business model yesterday.
But they could be, that's why it's a conspiracy theory.
Other parts of the company want to support the public.
The first part of the company backs up the second in internal politics.
Do you consider this a conspiracy? Just seems like “good business” to me. It doesn’t seem as clean as you want to make it seem, though.
The same view point is used for racism, dei, and the rest: it doesn't matter if the poor beggar on the corner hates white people. They don't have any means or methods to act on it.
> 19–24 August 2026: Wiz Research independently collides with the same bug family using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, reporting its variants on 24 August.
I again ask how they are lying? I get if people hate these companies, but blatantly disregarding what is said helps nobody.
CEOs of all big corporations are constantly lying and misleading the public, investors and shareholders. That is a crime. A shame that it is not enforced anymore.
But of course there would be no marketing.
[1] From whom you stole everything in the first place.
Most people license out the software under specific requirements and prohibitions. BSD requires attribution. GPL variants require adherence to copyleft when distributing derivative works. A little under half of all github repos don't even have a license, which means that though the source is published, no one has any license under which to copy it or derive new works from it.
So far as I have seen, whether aggregating and munging these works into abstract LLM weights constitutes fair use is still legally unclear. If not deemed fair use, it is almost certainly a massive violation of copyright.
If you don't want your code to be used as possible inspiration, then you are not actually for open source, and are using the wrong license. The licenses are legal bindings, not moral bindings.
"Don't use any concept found within this code" would be a license that doesn't really fit with any current copyright law, and it wouldn't allow any software to exist, except that made in the 70's.
That is, they knowingly and willingly broke the law by stealing an unprecedented volume of proprietary, copyrighted materials.
Books: Bartz v. Anthropic
Films and TV: Disney Enterprises Inc. v. Midjourney Inc.
Music: Concord Music Group, Inc. v. Anthropic
Photography: Getty Images v Stability AI
Journalism: Postmedia Network Inc., Torstar Corporation, The Globe and Mail Inc., and The Canadian Press v. Anthropic PBC
[0] https://en.wikipedia.org/wiki/Grand_Upright_Music%2C_Ltd._v.....
Or at least just childishly naive for failing to notice that beforehand.
The point of the open source I work on is to contribute to a commons, not to have it stolen so that it can be used to destroy those commons, used for the profit of techbros, and used to justify the murder of children.
To be further pedantic, is that really stealing? They are disregarding copyright but was anything taken from anybody? I thought that was the old argument for piracy, ie, nobody was deprived of anything.
This works for established profitable brands that want to build / maintain a good public image.
This isn’t the marketing needed by an unprofitable startup that wants to show hyper growth before its IPO. They need the “use our product or get pwned” kind of marketing.
https://openai.com/form/enterprise-trusted-access-for-cyber/
"Daybreak enables vetted enterprise customers and cybersecurity practitioners to use our most capable models for dual-use cybersecurity work."
They explicitly give out access to those who will make a big announcement of bugs found. OpenAI does not want projects to fix bugs themselves so it can have more bugs and better marketing.
https://openai.com/form/codex-for-oss/ is their program for giving access directly to open source maintainers directly so they can fix bugs.
I wouldn't expect the PHP team to provide patches for versions for which security support has ended. But this seems like the kind of task that AI is especially well suited for-- rework the patch for a release that is no longer supported but still widely used. It would've been nice for people who have much older sites to be able to patch their PHP rather than have to upgrade PHP as well to get the fix.
Just give us the damn code to verify things are working since so many have to use stopgap solutions and want to verify them
I'm sure they named it after the "Hack the planet" slogan from the Hackers movie.