Comment by nr378
12 hours ago
It seems like OpenAI are trying to frame this as if AI did all the work here, but it's not really true given what Calif say (https://calif.io/php2shell/):
> How did we find this?
> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.
> There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.
They literally open by saying Calif used GPT 5.6 Sol, which is a widely available model. Yes, the person driving did more than "find all the bugs", but nowhere does OpenAI imply otherwise.
> It highlights how AI can uncover security flaws with internet-scale impact
> To our knowledge, frontier AI found these vulnerabilities before attackers did
I don't know who/what Calif is and there's no link to them, so if I were only reading this article I would definitely get the impression that "AI did all the work here".
Nobody works without any AI these days, most of us have access to the same models and yet we all do and achieve different things. It's a weird time.
7 replies →
Pure marketing, it's getting increasingly hard to separate actual technical feats of agents from marketing pretentious declarations. Such a terrible environment to navigate right now.
What’s worse is that this is part of a larger strategy of scaring the public to get regulatory capture
It’s just gross and manipulative. You have no moat, get over it
pAtCh ThE pLaNeT today, tomorrow it's creepy rent-seeking behavior
Damned if you do, damned if you don't. Do you prefer they not engage in helping finding vulns at all? Do you not think there are parts of the company interested in security and doing it for the sake of that?
I feel like taking every action these companies take as part of some larger strategy is kind of conspiracy-minded.
7 replies →
I don’t think it’s marketing but the fact that all the labs don’t immediately agree to stop further release until security is more established shows the profit motive is inappropriate for this industry and needs to be removed from them. You don’t get to threaten humanity while cashing in stock to buy a San Francisco mansion.
It's not hard tho, the default mode of thinking should be to never trust what a US corporation says.
Why limit only to the US?
4 replies →
Not marketing. It is a crime related to fraud or securities fraud.
You're claiming this is securities fraud?
5 replies →
This isn't a security incident as much as it is a marketing opportunity for all these companies.
OpenAI: your misfortune is our PR opportunity
> OpenAI are trying to frame this as if AI did all the work here
CEOs of all big corporations are constantly lying and misleading the public, investors and shareholders. That is a crime. A shame that it is not enforced anymore.
Just more IPO shilling from the scam-man.
Thanks for the "Ski-bi dibby dib yo da dub dub" earworm