Yes, that sounds about right. LLMs aren’t quite good enough to find novel bugs and exploit them like a human would.
Re:A buffer overflow in the XNU kernel
by tedunangst on Thursday June 20, 2024 @07:09PM
(#40744484)
Yeah, that works for web vulns where the vuln description is practically the exploit anyway. I could write a perl script that parses out variable names and writes sql injections for it.
Re:A buffer overflow in the XNU kernel
by poincaredisk on Friday June 21, 2024 @01:17AM
(#40746380)
For comparison, in the native world program is considered vulnerable when someone finds arbitrary write primitive (even without leak), use after free, and even double free. There is a huge gap between these and actually having a working RCE exploit. Most CVEs in this space are given without a working exploit ever written.
GPT-4 can exploit vulnerabilities by reading CVEs (theregister.com) 81 points by ignoramous 60 days ago | hide | past | favorite | 29 comments
https://news.ycombinator.com/item?id=40101846
which links to a Register Article[0], which links to a paper[1]:
"In this work, we show that LLM agents can autonomously exploit one-day vulnerabilities in real-world systems. To show this, we collected a dataset of 15 one-day vulnerabilities that include ones categorized as critical severity in the CVE description. When given the CVE description, GPT-4 is capable of exploiting 87% of these vulnerabilities compared to 0% for every other model we test (GPT-3.5, open-source LLMs) and open-source vulnerability scanners (ZAP and Metasploit). Fortunately, our GPT-4 agent requires the CVE description for high performance: without the description, GPT-4 can exploit only 7% of the vulnerabilities."[1]
[0] https://www.theregister.com/2024/04/17/gpt4_can_exploit_real...
[1] https://arxiv.org/pdf/2404.08144