this post was submitted on 08 Jun 2026
38 points (95.2% liked)

Cybersecurity

10069 readers
97 users here now

c/cybersecurity is a community centered on the cybersecurity and information security profession. You can come here to discuss news, post something interesting, or just chat with others.

THE RULES

Instance Rules

Community Rules

If you ask someone to hack your "friends" socials you're just going to get banned so don't do that.

Learn about hacking

Hack the Box

Try Hack Me

Pico Capture the flag

Other security-related communities !databreaches@lemmy.zip !netsec@lemmy.world !securitynews@infosec.pub !cybersecurity@infosec.pub !pulse_of_truth@infosec.pub

Notable mention to !cybersecuritymemes@lemmy.world

founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] hirihit640@sh.itjust.works 2 points 1 day ago (1 children)

So I guess we're finally admitting that AI is really good at finding vulnerabilities and exploits, even if the prompter isn't

[–] CorrectAlias@piefed.blahaj.zone 3 points 1 day ago* (last edited 1 day ago) (1 children)

The argument is not if it can find them or not. The point is that most of the vulnerabilites it finds aren't exploitable directly, and these are what are currently plaguing the open source community.

Yes, it can find actual exploits, especially if the attacker is motivated and knowledgeable enough. But the amount of slop like "this inaccessible private function has a bit overflow exploit if you change x variable before compiling" greatly outweighs the actual exploits.

[–] hirihit640@sh.itjust.works -1 points 1 day ago

That is not slop, if the developer didn't intend for that behavior it's still a bug. Though you could argue that some bugs aren't that important. I'd argue that even if we filter those out, we're seeing that the amount of important bugs is still beginning to overwhelm open source developers.