Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2025-59419)

Posted by ponderwonder on Tuesday October 21, 2025 @03:19PM
from the depthfirst.com dept.

https://www.depthfirst.com/post/our-ai-agent-found-a-netty-zero-day-that-bypasses-email-authentication-the-story-of-cve-2025-59419

( 4 comments | 8 points | on HN )

Re:Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2... by bmit on Tuesday October 21, 2025 @03:23PM (#45660420)

It is surreal to see a zero day like this being caught entirely by AI. What was the toughest part about building this?

[ Parent | on HN ]

Re:Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2... by bmit on Tuesday October 21, 2025 @03:27PM (#45660477)

Also, a clever title.

[ Parent | on HN ]

Re:Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2... by adrianbd on Tuesday October 21, 2025 @05:17PM (#45661834)

Brilliant use case - to what degree is the agent being guided? Is it mostly a pairing exercise or agent exploration followed by human validation?

[ Parent | on HN ]

Re:Casting a Net(ty) for Bugs, and Catching a Big One (CVE-2... by ponderwonder on Tuesday October 21, 2025 @05:32PM (#45661993)

I pointed it at the library's git and let it run from there! I validated all the output (vuln description, risk assessment, exploit poc, patch) before reporting to maintainers

[ Parent | on HN ]