If you have ever actually seen the discovery process, you’ll understand that bugs and rce’s don’t just popup on a list from a computer. Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it’s confirmed. It’s not just the discovery of a starting point that constitutes an rce or other vuln, there’s a ton of work that needs to be done by humans also.
So a few bad ones in the news? Sure. A list of 1500 non-validated rces? I’m not holding my breath.
You really have to think critically and let go of the “hacker” sensationalism in infosec, it’s easy to fall into.
Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it’s confirmed
i guess you didn’t actually read the blog post this article links to? The number in the headline (948) is the number of LPE bugs which they say they validated and reproduced and developed exploits (and patches) for.
I did. The article is scant, and the source report is everything bad about ai in the vuln world; high drama, low info. LPEs are not RCEs!
And we don’t know what the exploits are. If it’s a bunch of local jvm consoles or vi escapes into shell where it’s like “oh this could give you root!”, that’s not super useful without knowing if it’s a dumb initial config or an actual use-after-free or other memory exploit.
That’s why we don’t classify manufacturers with bad/no default creds as CVEs, that’s just bad
Like I said, there is a lot of work to do before these become legit, and it almost certainly won’t be 958 exploits after actual professionals review them properly.
And again, stop taking OpenAI at their word about security.
I don’t want to belabour the point, but openai also said it’s agents “hacked” hugging face, but that is now documented as very ‘helped along’, so take their claims however you like.
What that tells me is that LLM agents can augment human hackers to perform feets neither could do on their own.
I don’t know why I would then conclude OpenAI is simply lying about even finding exploits. It’s believable that human programmers, using LLMs, have been able to find exploits. They’re going to lie and give more credit to the Wizard than to the man behind the curtain, but that doesn’t mean the exploits themselves aren’t real.
If you have ever actually seen the discovery process, you’ll understand that bugs and rce’s don’t just popup on a list from a computer. Sure, you can generate a list of places to start testing, but each of those has to be validated, reproduced, documented and understood before it’s confirmed. It’s not just the discovery of a starting point that constitutes an rce or other vuln, there’s a ton of work that needs to be done by humans also.
So a few bad ones in the news? Sure. A list of 1500 non-validated rces? I’m not holding my breath.
You really have to think critically and let go of the “hacker” sensationalism in infosec, it’s easy to fall into.
i guess you didn’t actually read the blog post this article links to? The number in the headline (948) is the number of LPE bugs which they say they validated and reproduced and developed exploits (and patches) for.
The amount of people who will speak confidently without knowing the full picture is astounding.
I did. The article is scant, and the source report is everything bad about ai in the vuln world; high drama, low info. LPEs are not RCEs!
And we don’t know what the exploits are. If it’s a bunch of local jvm consoles or vi escapes into shell where it’s like “oh this could give you root!”, that’s not super useful without knowing if it’s a dumb initial config or an actual use-after-free or other memory exploit.
That’s why we don’t classify manufacturers with bad/no default creds as CVEs, that’s just bad
Like I said, there is a lot of work to do before these become legit, and it almost certainly won’t be 958 exploits after actual professionals review them properly.
And again, stop taking OpenAI at their word about security.
They didn’t say they were, the post is very clear about the the 948 vulns they’re talking about being LPE.
if it was that, they wouldn’t be “Linux LPEs”. These are clearly kernel bugs they’re talking about.
OpenAI is full of shit about a lot of things but I doubt they’re lying about having working exploits for these Linux bugs.
I don’t want to belabour the point, but openai also said it’s agents “hacked” hugging face, but that is now documented as very ‘helped along’, so take their claims however you like.
What that tells me is that LLM agents can augment human hackers to perform feets neither could do on their own.
I don’t know why I would then conclude OpenAI is simply lying about even finding exploits. It’s believable that human programmers, using LLMs, have been able to find exploits. They’re going to lie and give more credit to the Wizard than to the man behind the curtain, but that doesn’t mean the exploits themselves aren’t real.