Posted by hacb 11 hours ago
On February 2, 2027, we will move to a “Full 60” policy where vulnerabilities are disclosed after 60 days.
On January 3, 2028, we will move to a “Full 30” policy where vulnerabilities are disclosed after 30 days.
Reality is more complicated than that.
https://en.wikipedia.org/wiki/List_of_Internet_top-level_dom...
“Don’t like our constant stream of patches? For $10k/mo + tokens you can get access to the model to patch the vulnerabilities we disclose!”
The dynamic in this context absolutely has changed. Marginal cost to discover vulnerabilities from AI frontier labs and the big players has dropped significantly. The cost to patch is low, if you have access to certain resources. If you don’t, tough luck.
So this argument is essentially against the entire argument of AI alignment guardrails right now. Maybe you disagree with those, but I for one am happy they’re doing some things to protect against bio related warfare engineering. This is a case of cyber that’s about grey. Even there the labs have limited access to some and are choosing winners.
In any case it’d be sensible to make yourself familiar with the “specific effort” before you make up your opinion on it.
I mean, sure, the cited $10k / mo is exploitative for small open-source projects but... in general, why wouldn't we want there to be pressure on companies and projects to use high-quality LLM-based checks if they want to see wide adoption?