Is this the new cyber normal?
drew.silcock.dev161 points by drewsberry 21 hours ago
161 points by drewsberry 21 hours ago
There are two aspects: first that there is currently a much higher pace of critical vulnerabilities and exploits being discovered, and second that there is a much shorter window between discovery and large-scale exploitation.
People are saying the pace will settle down once LLMs find and fix all the bugs. Okay, sure, if you want to believe that sort of thing, but that still leaves the much shorter time window, and that's not going to go away anytime soon.
If you're on the side of the industry where your job or hobby involves breaking things, this is all very exciting. But if you're on the side of the industry where your job is to prevent things from being broken, then it really sucks.
I lost a full day yesterday because some big players discovered a thing, told other big players about it, "oopsed" enough public information to let everyone else know about it, and then left everyone else to figure out what to do with almost no information to act upon.
This cycle has happened several times this year now. If you're on the short list of big hosting providers, you get advance notice of what's coming and early fixes; if you're not, sucks to be you, hope you didn't have any plans today.
For people like me, this is just yet one more way LLMs are making my life materially worse.
The coordinated disclosure thing will have to stop soon. Ideally, if you found a vuln from the defensive side, you'd tell all the "good guys" about it and none of the bad guys. The world doesn't work that way, so instead, the compromise was to tell a small number of important big actors who were unlikely to leak it, so the most good could be done before everyone found out.
Now the simple knowledge that there might be an exploitable memory issue in some given piece of software is enough for bad actors to point LLMs at it and find the issue in hours. That will only keep getting worse.
At some point, it's going to become a speed game. If you find a vuln, you might as well disclose to everyone immediately. Anyone who runs internet-exposed software will need an agent watching for disclosures around the clock and triaging them automatically (either by upgrading, improving filtering with some protective shell, or taking the whole service offline until humans can help) to keep up with the offensive agents watching around the clock and attacking automatically.
> Now the simple knowledge that there might be an exploitable memory issue in some given piece of software is enough for bad actors to point LLMs at it and find the issue in hours.
It is all but certain there are exploitable memory issues in Chrome, Firefox, Node.js, Linux kernel, Nginx, etc.
Can we expect CVEs in a few hours? I'm sorry I ruined everyone's weekend.
I'm wondering how long till we see the first exploit that goes like this:
* A bad actor finds a real, theoretically severe but not easy-to-actually-exploit vulnerability in some popular software. E.g. it's an exploit that can get you pwned 100% with RCE, but only if you are using it in configuration X on platform Y with kernel version Z on a Tuesday.
* They design a patch that closes that vulnerability but subtly opens a more dangerous one known only to them. They privately test their patch against LLM reviewers, tuning the approach until the introduced vulnerability typically escapes detection by automated review.
* They "responsibly disclose" the original exploit and helpfully share the patch. In the hurry to fix the original exploit, the patch itself gets only cursory (claudy, codexy) review. By now this has happened so many times that just applying whatever code changes ClodSed were GTG is the status quo.
* When the new vulnerability is eventually discovered, they can plausibly say "oh my agent didn't catch that", which is true. In the meantime, they use the new exploit that only they know about.
One can defend by quarantining any submitted fix, developing your own without reading it. Then only after that compare them.
In any case you don't even need malice --- sincere reporter can vibe up a fix that accidentally introduced a vulnerability, owing to their own lack of domain expertise and model errors... and then this bad fix makes it in because in the thrall of confirmation bias you fail to notice its shortcomings. Reporter also presumably tested it against their own LLM, so that will pass too.
This happened recently in a cryptocurrency project and contributed to a significant exploit.
This was already a thing before AI, the term is "variant analysis". But it's been way juiced up by LLMs and is 100% a major cause for concern.
> the patch itself gets only cursory (claudy, codexy) review
FWIW Claude is actually quite good at discovering variants of existing bugs.
> If you find a vuln, you might as well disclose to everyone immediately.
This still doesn't work, since attackers are much more motivated and able to pay attention to such things.
If your goal is finding vulnerabilities / stealing money / whatever, you focus all your energy looking for new exploits.
The rest of the world has other things to do (listen to users, run services, whatever) and by definition cannot spend as much of their time watching every social media in the world for the chance of an announcement.
That's why anyone who has a lot to lose from a data breach had better either harden the shell of their system such that it's not vulnerable (very hard to do correctly) or automate the process of listening for and reacting to vulns.
> or automate the process of listening for and reacting to vulns
1. This is also very hard to do correctly.
2. What automated steps would you take without any patches available to apply?
3. Potentially makes you more vulnerable to supply chain attacks
> People are saying the pace will settle down once LLMs find and fix all the bugs
Yeah I don't buy it either. Look at github right now, it is a total slopfest with people vibing projects they don't know the first thing about. Plenty of LLM use will be delivering code full of new exploits. It will be interesting to see the frequency of these exploits being found correlated to LLM friendly/unfriendly contribution policies once the dust has settled to tell for certain though.
I have the opposite view: these vibe-coded projects are MUCH higher security than even top-talent human.
Ask a top agent today to create a to-do app and watch it deploy enterprise grade security: anti CSRF, XSS, CSP, secure cookies, HMACs, rate-limiting of logins, and all kinds of things you never heard of.
I've asked it to implement a simple OAuth and saw it classify inbound IPs for private/public subnets, and put in workarounds for very theoretical DNS re-bindings attacks.
We all know LLMs love to over-engineer stuff, they are having a field day turning your static 3 page blog into crypto-exchange grade security.
That may be true, but we're talking about core library vulnerabilities that major projects use, not one-off's that nobody else cares about.
> For people like me, this is just yet one more way LLMs are making my life materially worse.
I wonder if we start to hit a point where the pace that exploits are found and deployed increases faster than they get repaired, because there is a natural higher risk appetite for the bad actors, whereas the good actors still require careful thought and prudence. As a result of this, would the internet/digital economy largely seize up and crash? That would be bad, especially for a lot of people on this site. Maybe this leads to a regression in convenience, but requires more in-person interaction in order to function in society. You can already see this pattern today emerging in higher education. Maybe, in a deeper way, this improves humanity?
> People are saying the pace will settle down once LLMs find and fix all the bugs.
Only for projects that are in a maintenance state. New features will produce new bugs, unless everyone pays for the tokens to scan every release with the top-of-the-line agents or otherwise spends more time than many do ATM to ensure that changes and new code don't introduce significant exploit paths. Things will slow down once the low-hanging fruit from the past is mostly detected and pulled, but the level of vigilance will always have to be at least a little higher than it has been until recently.
Time between updates releasing and people installing them has been an increasing problem for some time, we are just going to have to be a lot more disciplined about that. This will be a problem for places that have strict availability requirements as they might have to compromise on the testing time they spend on new patches before updating their installations, and we might have to move to having more flexible maintenance windows (the old “an hour or two once a month after Patch Tuesday” hasn't cut it for some time and certainly won't going forward) to allow faster updates.
The bigger problem, compared to the patch-availability-to-general-use time which can be reduced somewhat via automation (though that might accelerate bad-patch based attacks…), is greater constraints for the time between bug discovery and patch release: as soon as there is a rumour of an issue many will start scanning for it (as that is easier now) so the time to wide exploitation is going to be much shorter. This might lead to buggy patches that add new issues of their own.
Perhaps we'll see a lot more projects having explicit LTS releases that only get security updates or signifiant bug fixes, which will reduce the attack surface area (and fault surface area) most users, letting those with less stability concerns deal with the bleeding edge.
> For people like me, this is just yet one more way LLMs are making my life materially worse.
I'm with you there…
> New features will produce new bugs, unless everyone pays for the tokens to scan every release with the top-of-the-line agents
Insufficient. Models available to you are already cyber-gimped today and seems likely that they will be moreso in the future (see the recent K3.1 announcement for example). There will be attackers that lack such handicap.
As an industry, we also know two more aspects
1. many have underinvested in security for a long time
2. many are checking out of the development process
I generally think we can improve software with Ai tools, but I'm skeptical the current incentives will lead to this.
> But if you're on the side of the industry where your job is to prevent things from being broken, then it really sucks.
It's called job security :)
That’s job security in the same way that a building maintenance guy gets job security from somebody filling the toilets with garbage everyday and flooding the bathrooms
Like sure it’s true that you’re more necessary now, but when you took the job you weren’t expecting to need to be elbow deep in shit every day, and you’d probably prefer to go back to the days of changing lightbulbs and vacuuming hallways
I've been on software projects where more time was spent shoveling shit like this than doing real work. It's only going to get worse.
The web as we know it was never securable. LLMs made it obvious. We made a wrong turn somewhere back around JavaScript. Eventually we'll get fed up with the quick fixes and design something better. I don't blame the LLMs for this. I blame whoever made that wrong turn back in the 90's (and us, for not turning around sooner).
You're blaming JavaScript? The language that succeeded at delivering fully sandboxed rich client-side applications better than any other tech? With the worst incidents generally being 'just' various forms of fingerprinting?
Or, if you're thinking server-side JavaScript: would the web have been more secure running PHP and Python?
The language that made it normal to blindly run code that you found lying around on some page? Elsewhere we'd call that a remote code execution exploit. JavaScript just calls it another day at the office.
And it's not fully sandboxed. It betrays its user all the time by abusing unrestricted access to the network, or activating browser functionality that most of us would disable if we could.
I'm not saying it's THE bad decision, but it is the product of a generation of thinkers who were not thinking about threats the way we do now. If we were to go back in time and have the opportunity to do it differently, I think we would take that opportunity.
But we don't actually need a time machine. We can just accept some sunk costs and move forward anyhow.
To be fair, Java applets and the Flash plugin socialized that before Javascript tried to walk us back from the edge just a bit.
And before that, whatever Microsoft "macro" or embedded code variant was popular that week in all those document formats...
Blindly running client side code (within a very carefully designed sandbox) is necessary for the modern web to operate, and people like the modern web.
We aren't going back to a page refresh every time you want to update something any time soon
Are you sure people like the modern web? It's increasingly used as a weapon against them. I don't know anybody under 20 who likes the modern web. As for the others, I think its more about nostalgia.
> Are you sure people like the modern web?
People will often claim to dislike something, even though they would dislike the alternative even more (and they might even be actively choosing against the alternative). Pay more attention to what people’s actions reveal than what they claim.
(This happens not just in tech.)
The tech that made the old web still exists. Everything is a GET, a form POST, and needs a page reload. You can still use tables for layout like it's 1996.
1. I'm not proposing the users go back and live in the past. I'm proposing that we, the technologists, go back to the drawing board as it existed at that time and build a different future.
2. I'm not going to feel safe if I go make a web site that works that way. I'm going to feel safe if my bank does.
People do? I loathe the modern web.
Give me a https://motherfuckingwebsite.com/ instead.
Perhaps the web was more secure when it wasn't running anything—just serving up static web pages?
Sure. It was also a lot less functional.
Kind of, but in practice not really. Sure, something like a photo editor would never be possible in Web 1.0.
But 99% of web applications are forms and displaying stuff. All JS accomplished is making it look prettier and enhanced tracking.
I mean, Facebook, my bank, Amazon… these can all be created with no client side code. It would be a lot of refreshes, but it can be done.
> I mean, Facebook, my bank, Amazon… these can all be created with no client side code. It would be a lot of refreshes, but it can be done.
HN could too - perhaps the biggest use on HN is not refreshing when up (or down) voting something. YouTube could do something similar - refreshing when 'liking' a video or getting more comments. But would you really find those to be a better experience for you? Even on actions that HN does refresh on, such as 'Next page', or submitting a comment, HN doesn't freeze sorts, so posts and/or comments you didn't see will often invisibly end up before the new location HN sent you to (or posts/comments you already saw earlier in the list now showing up "again" later in the list).
You can have the buttons in iframes and have that POST and refresh.
Not saying that's exactly what should be done, but an example that there may be another way than full-on generic code execution wrapping XHR.
Ah, so I guess the idea is that this page (which has ~200 comments) would have 200 iframes added to it?
A declarative approach would go a long way. Like, I'm not evaluating restaurants on the basis of their website quality, so why not have a restaurant browser and they can all just expose data according to some common schema. Same this with banks. Same thing with most things.
If you want a wildly interactive art experience, just load the appropriate browser for that.
I have to wonder, what is the real substantive number difference in exploits. Its in the hype train's interest to pump the CVEs in both quantity and severity so I do wonder how much of that is happening.
The time to exploit is also somewhat hypothetical. We're assuming infinite attacker resources which hasn't really been the assumption.
We see a lot more news and fear but are we seeing more actual "large scale exploitation"?
I'd love to see some numbers in that regard.
> For people like me, this is just yet one more way LLMs are making my life materially worse.
AI skynet is killing humans. We know that already though.
You were the one hosting an exploitable application.
You say this like it's their fault. The only way not to be sure you won't end up hosting an application vulnerable to a 0-day is not to host anything at all.
> first that there is currently a much higher pace of critical vulnerabilities and exploits being discovered
The slowest that will ever be.
> second that there is a much shorter window between discovery and large-scale exploitation.
The longest that will ever be.
Aren’t exponentials beautiful?
The security debt is temporal and going to decline because old software is going to be patched or thrown away and new one is going to be security-scanned and tested.
I'm very positive about the change. If we don't look at it purely technical, vermin from ransomware gangs and Russian/Israeli/USA spy agencies already knew a subset of these things. That shows how vulnerable we were, actually. What's a stupid bug for one, might be life and death question for another. Before, from business side of things, there was no urgency to maintain proper security and fix things, now we have a more equalized grounds and everyone has to invest both in security assessment, sandboxing/better isolation on system level and formal verification.
That will literally improve small countries and individual sovereignty against the spies and improve the humanity in the long term.
While it's a pity for many maintainers during the transition, after some time we will have much better world where you can trust your computer regardless of who you are.
It's complacency and having consciously or naively relied on security through obscurity for so long. Now that LLMs are a thing, such design flaws are trivial to expose even for the lay person, leading to a pretty massive awakening of how bad it all really was all this time, or what kind of stupid decisions have been made (i.e. the supermarket cooling incident).
I suspect the problem will solve itself though eventually, as the threat level of bad security practices has risen now, so companies have incentive to throw money at the problem for risk management, and LLMs may just as well assist with detecting potential exploits during the design phase. Thinking of it this way, I believe that security will actually improve a lot in the near future.
> Maybe we just need to accept that if you expose something to the wider internet, it will get hacked, and plan accordingly. Maybe it’s our expectations that are at fault.
It's this.
Everything I've read indicates that yes, this is the new normal.
When Mythos was first announced, pretty much every security expert I talk to freaked directly out. A significant portion of my job now revolves around mitigating the impact of AI-generated exploits.
The rate at which we're churning out AI-generated code is going to make this worse, too, because AI-generated code is kind of notoriously terrible at security.
_Is_ AI generated code notoriously terrible at security?
My experience with AI-code is that it's extremely defensive and good at minimizing 'obvious' mistakes.
Are we comparing to old models generating code? Or mythos-class models?
It very much depends on how you generate it, from prompting to test suites, but most importantly, your attitude. The extra security costs you time and money.
There are still folks, many of them, who think that time to market is everything, and anything beside it should be ignored. "It compiles? Ship it!" is a phrase from 1990s; LLMs just make this approach much easier. We will have plenty of machine-generated software with the security posture of a colander hit by a buckshot.
Its not entirely a prompt issue, but also what it was trained on.
Nowadays, the frontier is pretty decent all around, but it used to be generated php/javascript was questionable, ts was a bit better, and Rust was consistently decent.
Even just setting the max width of your README to 80 chars vs using full markdown could get you very different C code.
My take is that its pretty easy to write _much_ more secure code; use fewer dependencies and the ones you have should only do what you need them to do with no superfluous unused code compiled in. Configuring that used to be too much work, now its a single prompt.
Most software is written without giving a thought to security. Because security is a source of cost. That was the case before LLMs, I don't think it will change with LLMs.
Now I wonder: given that the LLMs are steered by the companies who own them, doesn't it mean that they can somehow make security better? It cuts both ways obviously: that a company can read and generate a large part of the code in the world is a risk.
As an open source maintainer, I can most definitely tell you that the quality of the average PR is now better. The problem I am facing is more that some people tend to "flood" and misuse AI in different ways. But their AI writes better code than they do.
I think that even worse is that AI might choose just to write something, and skip using a library that is well maintained
Or use an out of date library.
In our somewhat “developer assisted” AI development it planned to use a library. We looked the library up and the GitHub page indicated it was “no longer maintained use other library Z”. When told AI agreed and compared the original to the new library (helpful), but it seemed to heavily weight GitHub stars more than active development.
Tools like SCA and SBOM are still needed to ensure your stuff isn't out of date. That's not exactly a problem an LLM solves.
When a project talks about how many stars they have, I immediately mistrust them.
Usually download counters and stars are signals for VC, which indirectly serve also as negative signals to me.
This is where a human with a discerning taste and wide knowledge of the field should notice it during a review, or at least instruct their agents to check for that. If such a human is still employed in this capacity, of course.
that can sometimes be a plus considering how dependencies used by a lot of projects are themselves targets
Physician heal thyself?
Tell an LLM to break into its own system as part of a feed back loop, but with no context of the initial creation? It should iteratively get to 'safe' shouldn't it (subject to the tokens you want to spend)?
I’ve found they won’t always comply with adversarial review.
No doubt because us unwashed masses aren’t blessed with the super special “security” ones.
We might be looking for exploits for bad reasons, I guess.
It is not just code, it is also deploying Software. I constantly have to correct or steer the 'ai' in conversations towards safer directions or better following even the most basic security principles. Here I feel it is still more the overambitious intern that needs to be carefully overseen, but has a lot of time and energy at hand.
Yeah they are pretty bad at it still, latest models tried to ship a basic SQL injection flaw. Was also happy to build out an xss flawed module end-to-end. Definitely have to keep a close eye on it.
My vibe code friends have pretty much infinite security issues. Don't even have basic data modeling at client-server boundaries or anything. Also had Google analytics embed that read and saved everyone's credit card details as clear text in analytics.
Seems to make pretty much infinite mistakes if you don't take care and tell it what not to do or how to build certain features.
What models are people actually using to pump out code? That is the relevant comparison, not the absolute best in class models.
It's been shown to be bad at secure coding _unless_ you specifically prompt models to watch out for common vulnerabilities, at which point they're actually quite good at containing the issues, though the studies here are somewhat older (eg https://arxiv.org/abs/2211.03622).
The issue then is that most people aren't actually good at keeping an eye out for security issues in code proactively, so things slip through the cracks (whether human-written or not), just at a much accelerated pace.
That study is from 2022, with at most a last update 2023? (if I read it right)
I'm not at all saying that "oh 3 weeks ago, discard", but three years ago absolutely has a "before and after".
Three years ago AI generated code could basically not be used at all, and I had to rewrite just about every line. Today I have to watch out for generated code making steps in the wrong strategic and architectural direction, and over engineering, no longer hallucinating nonexisting APIs and forgetting to check the auth token.
I still look for those kinds of mistakes, but I think citing a 2022 paper for "can AI do X" is not useful.
It just means that the safeguard we put in place over decades of software engineering with humans also need to remain in place when engineering with agents.
Having properly validated libs with separate concerns and a lot of eyeballs (and agent sensors) on the code so that it can be integrated cleanly in other products. Static code analysis for our apps. System prompts that require output to be secure, etc.
All of these practices that have been touted to be obsolete because agents can now just generate tailor made code just when and where you need, are anything but obsolete. On the contrary, they are paramount to the future of software engineering.
from your paper:
> Overall, we find that participants who had access to an AI assistant based on OpenAI's codex-davinci-002 model wrote significantly less secure code than those without access.
That model came out in March 2022, it's GPT-3.5 !!!
I'm sorry but it's absurd to use that as evidence for anything related to AI coding today.
You can't just hedge by saying "it's somewhat older". It's like discussing dunno a new train connection between cities and citing a paper measure steam locomotives.
Hence why I said the studies here are quite old, and I'd like to see something more recent, though I guess it'll be some time before that's done.
I think most people writing code with AI nowadays will find it's still lacking in some areas. Not because the model isn't good (definitely miles ahead than what we had access to in 2022-2023), just because it wasn't actively mentioned and so the model skipped over it. The same will apply to security.
I'd also love to see recent studies. It's frustrating how even new studies end up using models which are behind the frontier at the time of publishing.
AI is advancing faster than academia can keep up. Which in general shouldn't matter. But you have this pattern where a paper comes out with a conclusion that just doesn't hold anymore by the time it's read, but people use it to form/support opinions.
I agree that we can’t compare older models to newer ones, but how much code was generated during those months/years when the models weren’t good at secure code? How much is still running publicly today? It’s still worth considering the impact to the overall ecosystem.
Luckily we have newer models going back and fixing these things.
In terms of the set of all bugs, the AIs from 2022-2023 pale in comparison with the amount of bugs written by hand in previous half century, even if 2022 AIs were worse than the average programmer.
like most software, do you assume people are driving lamborghinis, or the cheapest make and model they can find...
You just need to use AI to test your AI code.
(What a wonderful new world we live in)
I know you're joking - but I think it will remain a challenge.
Quality and Security are emergent properties of software - especially when considering software-as-deployed in the real world.
And the problems with "good taste" and good architecture and data modelling - will probably leave ai code open to a lot of issues (Claude code cli issues is a great example of how bad this can get).
Having good architects in charge can help - but it requires a lot of discipline to keep the feature set small so that maintaining quality and security become feasible.
It _is_ wonderful. You're never required to adopt software engineering best practices, but eventually everyone does because either it makes our lives easier or code better.
Having tests / CI pipelines, etc are the same thing? Now you can choose to add a cheap step in your pipeline checking if e.g. some engineer did something stupid like allow SQL injections.
The floor of software quality once it gets to review is permanently raised.
Dystopian days, where you will be forced to write some syntax, that is then handed off to a an Ai tester. The tester will return it to you ready for handing the code to three frontier Ai's. The judges of code.
They approve your code, gold, if not; back to the coding machine and minus 1000 human tokens. This will be done via the implants of brain chips
Wait, when did brain chips enter the picture?
Gabe Newell's Valve brain chip hits market and everyone gets one because Valve consistently gets left out of the "evil big tech" stack for some reason.
According to some independent thinkers, we all got them from Bill Gates’ COVID vaccines.
I really don't get the issue here. Is the rust borrow checker dystopian?
You're forced to write syntax that appeases the tester. If they are not happy you need to return and rewrite.
As software engineering matures, we're adding more linting and static checkers in codebases. This is generally considered good.
> You're forced to write syntax that appeases the tester. If they are not happy you need to return and rewrite.
that's called the write/compile/check loop
but if suddenly it's ai, people freakout at having to do this?
It was never the skilled way of doing things.
Also an AI is not a compiler, stop saying that.
Compilers transform source code in one language to another target language.
Transformer models can transform natural language to another target language.
That’s the commonality. What’s the distinction you want to make?
Can you explain the asymmetry you are claiming that exists where some models would be excellent at finding faults in code/systems and exploiting them often through coding the required tools to exploit them... but at the same time they would be bad at avoiding this kind of faults when coding the system itself?
Feels like you should be able to prompt the kind of exploits you want to prevent and the model should be able to make the system secured against them, no?
When you know you're looking for an exploit, it's easily verifiable and you can iterate fairly rapidly and get fast feedback, you can just have a test that you don't get a 403 back or something. LLMs, in general, seem good at problems like this.
When you're developing, there's a ton of degrees of freedom, and security encompasses only some of them. To be sure, if you set up a quickly verifiable test for every security flaw, you could probably get LLMs to satisfy them somehow, but there's a lot of those, and it's not necessarily practical.
> The rate at which we're churning out AI-generated code is going to make this worse, too, because AI-generated code is kind of notoriously terrible at security.
I think this was true in the past but AI is helping us finding exploits which have been in our code for many years. All out there by humans. We’re seeing fewer customer reported issues, and despite the pen tests getting far more rigorous, we’re passing all of them. Obviously this is one data point, but I’m hearing similar things from my friends in security and ops.
Yea most the people I know working in cyber security weren't worried about mythos in a serious way. All the people selling cyber products spread fear over it because profit.Everyone knows there are exploits laying in wait. Always has been always will be.
Most the cyber security people I know were upset once llms came out that could do basic os int and author their own emails, and mimic speech/video. That's how the majority of real losses occur. No one even talks about it. It's mind numbing hearing about the zebras and unicorns when there are 10 billion ants entering houses a year. Exotic stuff sells...
Now lots of sane people are genuinely and correctly worried that turning all engineers into 24/7 sloppers is and will continue to make the world far more exploitable. That's the real risk as far as I can tell
I have the same experience. Most of articles I read was reducing it to "just a tool, nothing more"
> The rate at which we're churning out AI-generated code is going to make this worse, too, because AI-generated code is kind of notoriously terrible at security.
This seems incongruent with what we're witnessing. Right now we're witnessing vulnerabilities that are 6 years old be exposed. That code wasn't generated by AI slop.
Security has always been about attacker/defender symmetry. So if the attacker has an LLM so does the defender. Reality is, the tax is getting higher as security tooling extracts more perceived value.
Let’s not forget the AI industry developed the technology and infrastructure for that security nightmare to exists. And no, none of that was inevitable. At every single step the AI leadership took decisions that makes it more likely that we face the current threats
The AI just accelerated the discovery. The issues have existed for years and many major versions.
> The rate at which we're churning out AI-generated code is going to make this worse
Not only this, a significant number of developers have stopped looking at code, trusting the bots. I've seen major security regressions, bot rolled auth implementations, and falsified benchmarks... just this last week, all in projects that get hyped.
Rule #2 - do not blindly trust Ai output
It's not stupid if it works.
Concretely, I would like to see it benchmarked:
Have Opus 5.5 implement the authentication, with a 6.1 Sol reviewer. Out of 100 times, how often is the result insecure?
I wouldn't be surprised if it's zero times.
There is also the possibility of specifically prompting for a security audit on top, which would perhaps further lower the risk of overlooked issues.
Now one can say that due to the non-deterministic nature of the tools, there is always a non-zero chance of producing insecure implementation.
That's not really important here - obviously manual review isn't deterministic either, the risk will never be zero.
> Have Opus 5.5 implement the authentication
“Authentication” is extremely far from being the only relevant characteristic of security. That in fact is the whole problem with security: it’s a pervasive concern that has to be considered throughout a system, at every level.
The way the bots fundamentally work means that we can never trust their output. We have ample cases at work where bots catch human mistakes and humans catch bot mistakes. The important aspect here is not completely handing things over to the bots.
> I wouldn't be surprised if it's zero times.
Statements like this concern me.
If you're so concerned you can create such a benchmark and show us all how wrong my guess is.
Instead I mostly read such opinions based on active imagination and no concrete experience with using AI for such work in a setup as described.
I suspect you would disregard or find fault in any benchmark I or others provide you.
Alternatively, if you want to see a benchmark so badly, you can create such a benchmark for your guess. I would imagine you would have more faith in the results of your own work.
If someone were to genuinely tell me that with the two SOTA models with the review step, severe security issues were left in the code, I would believe it.
That's not what anyone tells me though. I only hear theorizing and vague references to how AI failed people.
You're spot on that the thing I trust most is my own experience. I'm mostly working on mobile apps, my project does not have user accounts, so I couldn't tell you about authentication.
However, it is my experience that these models got very good at catching high-priority issues if you use the review step as I described.
Thus I theorize that SOTA models are likely to produce secure implementations.
"secure implementation" is vague, for example, here is an OpenCode issue (links to related PRs/follow ups) that I worked with their team through to improve security.
Our hunch is that the Ai told them this was ok to do, but it broke invariants users relied on. Perhaps it was not "hackable" in the sense I think you are getting at, but it did open a very big security hole through choices and design. The critical thinking was lacking (imo).
https://github.com/anomalyco/opencode/pull/51337
The bots make mistakes all the time, even through multiple rounds of reviews. Thus I have zero faith that they will produce secure code reliably 100% of the time. More Ai does not magically fix this, they go down the wrong path and double down, or work around incorrect assumptions.
This is a good talk by a member of the Linux security team: https://www.youtube.com/watch?v=NnV_cWeoo5Q
Also worth noting that OpenCode Console was hacked days after the configuration regression and two PRs to change it back. Notable because it shows a pattern.
A poor design decision in OpenCode configuration handling is interesting, but not directly relevant to the question.
Assuming the question is whether not reviewing generated code is likely to create vulnerabilities despite SOTA models having audited the implementation.
Here it seems to have been a design choice, rather than an implementation mistake. I do not know what models were used and whether a review or audit has been done.
We are basically back at a vague the AI failed.
And sure, this happens, but there are some strong claims I'm reading here that are imo not evident:
- not reviewing implementation is foolish
- doing so will result in a flood of insecure software
- more AI cannot fix this
--
My arguments on each point:
- depends on risk tolerance, attack surface, error rate
- depends on actual performance of the proper setup I described on typical tasks, compared to the average engineer
- more AI can fix this, provided the audits become accurate enough to identify vulnerabilities with eg. 99.9% reliability
--
Are you sure that such accuracy for auditing is impossible, and will remain impossible in the future?