I suspect open source projects are better off than proprietary software - they already have many eyes on them, whereas commercial software that’s not a prominent and profitable target (e.g. windows, ios) hasn’t had much attention until LLMs made attacking them significantly easier
Worse is everyone is like "Well, this stuff is protected or air gaped". Yea, it's behind firewall, or even private networks commonly, but the moment you get inside that network you have tons of lateral movement and could cause unbelievable damage in minutes.
> Not maintained or developed by a billion dollar company.
Afaik everyone working on curl has a day job.
This has been disproven by the sordid history of OpenSSL. It was open source, critical, and full of holes.
https://www.mend.io/blog/how-the-heartbleed-vulnerability-sh...
https://www.controleng.com/throwback-attack-hackers-attempt-...
https://esemag.com/water/russian-hackers-breached-quebec-wat...
https://www.cbsnews.com/news/us-water-systems-cyberattacks-i...
https://www.bbc.com/news/world-us-canada-55989843
edit: formatting urls
Reminder that Stuxnet managed to jump an air gap (via USB keys):
Im still not worried about it. There's thousands of water treatment facilities in the USA and you've surfaced two occasions.
Ya'll should try actually breaking into something semi secure with an LLM, its not as easy as you might think. Seriously go try it, if you think its so easy there's millions of dollars to pick up off the floor on bugcrowd or h1. Seriously, please go give it a go.
Secondly, maybe the USA should stop committing mass murder across the globe if we don't want to be the subject of retaliatory attacks.
I would argue that systems were largely more vulnerable 5 years ago than they are now. Esepcially at a municiple level.
There seems to be a lot of "strategy of tension" being employed in these news cycles surrounding security and AI. Dont fall for it. You're fine. Systems are more secure now than they ever have been in the past.
But on the Israel note, thats awesome I hope more of that comes their way.
Airgaps don't solve everything either. Stuxnet was successful at destroying air-gapped machines.
Agreed. My fairly obscure company got hit by something like this last weekend. What stood out was the speed of the loop: it found something small, used it to uncover something else, and pivoted to clever exploits for the new thing within minutes. It hit a dozen of our apps in parallel across within the span of a day, from a rotating pool of residential proxies, Tor, GCP and Cloudflare IPs.
I'm fairly confident it was LLM-driven. The payloads and throwaway accounts had names like "PT59553 TEST IGNORE" and "PocCorp1659r2", and it adapted to error messages the way a person reading them would, just never sleeping. A non-tech company with 1000x the surface area and less monitoring could be in big trouble.
Of course I used LLMs for the defense too, and they were amazing at log forensics and fixes. The annoying part: when I asked Opus 5.5 for clear repro cases of exactly what the attackers did, I hit the cyber safeguards. It felt like Opus was intentionally trying to keep the exact exploits for my own bespoke applications away from me, though it was happy to point out how to fix it.
billion dollar companies are not exempt from this, in fact they tend to be the worst offenders
If there isn't data available to assess impact objectively, then this is just fluff and nobody has any reason to believe you.
I am unaware of any comprehensive analysis demonstrating that LLMs can identify and exploit private code repositories for major enterprises any more than they do open source technologies. Are you?
Beyond that, I'm confused. OP gives data supporting the idea that security concerns have been a puff-piece PR stunt. Glasswing's numbers are fake, and beyond that why on earth would a company not divert resources to processing vulnerabilities if they were sitting on a PR goldmine?
The response is "trust me bro, I've been working hard to fix stuff for a private company." Which doesn't tell us anything.
The OP gives us ample reason to believe that this commenter has been wasted their time on non-issues caused by LLM slop-reporting. This is consistent with my professional experience (and I'm confident resonates with the experience of many who actually work in the field).
The commenter theirself just says "trust me bro, private is different from public" which I do not have reason to believe.
I work for a private enterprise that has been deluged with security issues that we are fixing while adding zero value to the company due to corporate's response to "Mythos."
We are finding that almost none of these issues are valid.
I would love - LOVE - to hear some kind of valid, quantified, well-argued justification for the titanic shift of resources away from productivity and towards security.
I would love to look at actual data, or for you to make an actual argument, or for someone to make some actual sense on the cybersecurity doomsday front. I engage in good faith with good faith arguments. I have not heard any.
Make sure you’re still thinking.
Your condescendence level is over 9000.
We've sure seen that LLMs can make good assumptions about blackboxes and, unlike humans, are able to try many paths in a short time. However, one can't neglect that doomsday prayers have been present before the dawn of AI, and rarely companies got hacked.
From anecdata, the human is still most often the culprit for breaches, not the "We managed to penetrate that one byte often enough" exploit.
Please avoid patronizing barbs in comments on HN. I can believe you didn't intend to be mean, but it's easy for these things to be misinterpreted on a text-only message board. https://news.ycombinator.com/newsguidelines.html
They shouldn't. AI is great at some things and underwhelming at others, and it's never predictable if you're going to get the great response or the silly one and when you'll get it and over what topic. And you and the author combined are illustrating one scenario where that jaggedness shows up.
My understanding is that few have been critical vulnerabilities on their own, but LLMs are now able to piece together 10+ less critical vulnerabilities to create a critical exploit. So, some of the classic triage practices that rely on standalone CVSS scores should be coming into question.
Even if you have just have 1,000 low severity vulnerabilities today that don't add up to something critical, they might add up to something critical when the next model generation arrives, so you need to get ahead of those latent vulnerabilities. The safest approach is to fix everything, which is understandably difficult for OSS.
If that isn't possible, then we need new ways of prioritizing/triaging bugs... which would also make for a more interesting blog post than claiming Mythos is 'underwhelming'.
Public datasets of CVEs being underwhelming doesn't mean much if all of the issues are in private company codebases that will never get a CVE number assigned and will never get a fancy blog post. You're never going to hear about them, and the people working on them probably can't tell you about them, but that doesn't mean they don't exist.
We're all worried about OSS having security issues because of how widely used things like PHP or curl are... but the same can be said about email providers, document collaboration SaaSes, payment processors, etc that millions of companies depend. Those companies will never be in datasets like this, and they'll never publicly disclose how many issues they found.