Spending tokens to search for vulnerabilities in commonly used software makes sense because the payoff is large - hack once, exploit many.
However for unique, bespoke software (vibe-coded or not), the payoff is as small as a single endpoint. You’ve found an exploit in MikesOwnOfficeSuite and now have access to Mike’s PC. You’ve got to spend the same tokens again to find an exploit in SuesAwesomeOfficeApps. It still might be worth it in a spear-phishing scenario.
if everyone vibe coded their own offices it would be a heaven for big tech llm operators lining up their pockets of course, but the idea was that Mike is using something vibe-coded by somebody else. just target TinyLittleOffice and get everyone using it
Spending tokens to search for vulnerabilities in commonly used software makes sense because the payoff is large - hack once, exploit many.
However for unique, bespoke software (vibe-coded or not), the payoff is as small as a single endpoint. You’ve found an exploit in MikesOwnOfficeSuite and now have access to Mike’s PC. You’ve got to spend the same tokens again to find an exploit in SuesAwesomeOfficeApps. It still might be worth it in a spear-phishing scenario.
Security through obscurity is back!
if everyone vibe coded their own offices it would be a heaven for big tech llm operators lining up their pockets of course, but the idea was that Mike is using something vibe-coded by somebody else. just target TinyLittleOffice and get everyone using it
yep. casual vibe coders can't compete with whoever spends 10x tokens just on vuln discovery...