The bigger takeaway is someone that smart is pissed off and dropping their shit with zero warning... but hey, that's just like, my opinion man.
back
3 comments
You don't need to be pissed off to decide that immediate public disclosure is the best option.
Ok, I don't know their emotional state. Fair point.
Maybe I'm projecting my own biases ;-)
Meanwhile, some dude was just playing with claude and accidentally made his repo public.
The point is that anyone looking for zero days has them in spades, in this age of LLM use.
So, knowing that bad actors have an unending river of cheaply acquired zero days, the best response is to publish them so that maintainers also have access to them. Existing methods of slow disclosure cannot keep up with the AI firehose.
It’s ugly, but it will force needed change. A thorough AI red team effort is the lowest bar of releasing software responsibly in this day and age.
If only the AI tools didn't shut you down every time you were trying to red team your own tools. I've had to come up with all kinds of workaround scenarios, effectively bypassing the AI security processes in order to stress test my own systems.
This is ludicrous logic. We already know that there is an AI firehose. You don't need to do this. They should have used proper disclosure.
All this is doing is making the AI firehose worse.
You are assuming that most projects are responsive in today’s ai firehose climate. They are not. This at least
Tells users of those Projects to either find developers or write their own.
I’m onboard with this being suboptimal. But as someone who has filed >10 significant disclosures in the last month resulting from reviewing my codebase and had exactly zero responses, I can relate to the decision.
Approaching the maintainers would be ideal but time-consuming. Disclosing it like this is neutral I guess. Better than selling it in the darknet.
I do wonder though: if you can tell the AI to search for vulns, can't you also tell it to contact the right maintainer for each one found?
Unfortunately, yes.