400
Low-skilled attacker used Claude, Codex to breach 14 companies (www.helpnetsecurity.com)
submitted 3 months ago by to c/technology@lemmy.world
85 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 5 points 3 months ago (7 children)

Well the problem is that for example curl got flooded with generated security reports where only 5% had some true security potential. So your llm will basically flood you with false positives

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 5 points 3 months ago (6 children)

    If 5% of the reports are genuine security vulnerabilities that they wouldn't have found otherwise, that's looking like a big win to me, not sure how you see it differently.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 4 points 3 months ago (4 children)

    The problem is identifying which 5%. Nobody wants to filter that much AI slop.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 9 points 3 months ago (3 children)

    If you're working for a company's cybersec, that's your job. And a much preferable one to waiting for an attacker to do it for you.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 6 points 3 months ago

    If you’re submitting a vulnerability to a public repo, that’s also your job. These slop reports that are wasting maintainers time should never have been reported. The person tasking the LLM is out of their depth and can’t be the human in the loop that verifies the vulnerability report before submitting because they don’t have the required knowledge to do that. It’s a shame, because if people who had the requisite knowledge were the ones submitting, the ratio of valid reports to noise would be way higher than 5% and open source maintainers wouldn’t be feeling burned the fuck out.

  • permalink
  • fedilink
  • source
  • parent
  • [–] -1 points 3 months ago

    Sure, but nobody wants to do that, even at fair pay. Unpaid open source volunteer projects REALLY don't want to do that, and risk burning out what is typically a solo main dev.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 months ago

    No 5% is very low compared to before AI and this still does not mean the absolute number of found bugs has risen. From my understanding it didn't for curl. Further it is unlikely that bugs in curl are not found. Basically everything works with curl and it's a paid bug bounty program so a lot of security researchers are looking at it

  • permalink
  • fedilink
  • source
  • parent