Wow...
The Trillion Dollar predictive text machine, turns out to be nothing but hype (again).
AI-found bugs aren't proving any easier to exploit despite the hype
Anthropic's Project Glasswing may have uncovered tens of thousands of potential security flaws, but new research suggests AI-assisted vulnerability discovery has yet to produce the wave of real-world attacks many expected. In research shared with The Register, VulnCheck analyzed 1,061 publicly attributed AI-assisted …
-
-
Tuesday 28th July 2026 23:46 GMT BoHu
Re: Wow...
Yeah, lotsa smoke, mirrors, and hyperbole, like the super vague all glitter OpenAI/HuggingFace wowing of the crowds thing. IIUC the magical 'Houdini sandbox escape' was down to exploiting some JFrog Artifactory Ansible Deserialization weakness for Remote-Code Execution (RCE), and there are 19 publicly available exploits for this already, including the Ysoserial PoC ...
[ https://arstechnica.com/security/2026/07/jfrog-tries-to-spin-openai-0-day-exploit-of-its-app-into-a-success-story/ ][ https://www.cve.org/CVERecord?id=CVE-2026-65617 ][ https://arxiv.org/abs/2208.08173 ][ https://github.com/frohoff/ysoserial ].
Still, from the VulnCheck blog of this here TFA, I wonder why Known Exploited Vulnerabilities (KEVs) jumped from 100-300 per 6-month before 2023-2H to 400-500 per 6-month after that [ see 3rd plot at https://www.vulncheck.com/blog/state-of-exploitation-1h-2026 ]? Was that related to some improvement in AI (so-called) capabilities up to that time, followed by the flat lull of a plateau (peak AI), and then the beginning of a slow-ish demise towards oblivion? Inquisition minds ...
-
-
-
Wednesday 29th July 2026 16:53 GMT Henry Wertz 1
Yeah
Yeah in a lot of cases it's like an agrressive, power hungry lint. Here's a potential flaw! Is it even potentially possible to exploit? Often the answer is 'no'. I saw a flaw brought up last week, clear buffer overflow, fixed size variable but length check whatsoever at that point in the code. But unexploitable in practice because a bounds check *was* done by the caller of that function, and the shoddy function was not directly callable otherwise. I'm sure this code has been fixed but it's one of those ~98% with no exploit.
