It might be kind of overlooked when people read about the big scary results from mythos; the real breakthrough was probably just as much the application of the (very decent) model through a well engineered wrapper (harness). Other models including codex or glm result in significant findings as well.
I see "LLM discovers vulnerability in curl" and I get skeptical, given how Daniel Stenberg has talked about the flood of claimed vulnerabilities that weren't real issues once he looked into them (as most HN readers already know, I'm sure). But it looks like these 6 were real issues, that curl patched once they received the reports. Five ended up rated low and one medium, but given the amount of attention curl gets, I'd honestly be surprised if there were any high-severity issues; in fact, having even one medium-severity issue remaining is slightly surprising to me.
It might be kind of overlooked when people read about the big scary results from mythos; the real breakthrough was probably just as much the application of the (very decent) model through a well engineered wrapper (harness). Other models including codex or glm result in significant findings as well.
Harness example: https://github.com/evilsocket/audit
https://aisle.com/blog/aisle-discovers-6-new-cves-in-curl-in...
I see "LLM discovers vulnerability in curl" and I get skeptical, given how Daniel Stenberg has talked about the flood of claimed vulnerabilities that weren't real issues once he looked into them (as most HN readers already know, I'm sure). But it looks like these 6 were real issues, that curl patched once they received the reports. Five ended up rated low and one medium, but given the amount of attention curl gets, I'd honestly be surprised if there were any high-severity issues; in fact, having even one medium-severity issue remaining is slightly surprising to me.
To be fair (and for people who didn't click the link), i think most of the vuln were in libcurl, not in curl itself.