this post was submitted on 20 Jun 2026
313 points (98.2% liked)

Technology

85600 readers
3803 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots


founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] janus2@lemmy.zip 161 points 20 hours ago (5 children)

script kiddies wrecking corporate security is funny
prompt kiddies doing it is just depressing

[–] zane@infosec.pub 2 points 2 hours ago

As someone who works in security, llms just make security happen or not happen faster.

[–] A_norny_mousse@piefed.zip 37 points 15 hours ago (2 children)

And no-skilled attackers can buy exploits.

Claude helping is insignificant to the story.

The real headline should be:

At least 14 companies' IT security is practically non-existent

[–] Gust@piefed.social 2 points 1 hour ago

At least 14. *screams until hoarse in industrial cybersecurity researcher*

[–] eldebryn@lemmy.world 9 points 12 hours ago (2 children)

It is significant because a random teenager can't google "download exploits" and have them available 5mins later.

Powerful AI models and agents though are on your fingertips without you even asking.

Sure, people can buy guns. But what if every person could materialize a chainsaw instead regardless of their skill, maturity, age, or criminal record? 🤔

[–] 0x0@infosec.pub 3 points 5 hours ago (1 children)

Teenagers are definitely able to find exploits via google in 5 if they're motivated.

Buying a disassembled ak-47 on post order and having it shipped to your address anywhere in the world is also possible.

Rules only apply to people that care about them.

[–] MalMen@masto.pt 3 points 4 hours ago

@0x0 @eldebryn its not enough to find exploits, you have to know how yo use them... I can see how you can trick AI into guiding you to do a "pen test"

[–] nomy@lemmy.zip 17 points 11 hours ago

Random teenagers can absolutely google "download exploits" and have them available, that's pretty much always been the case..

https://www.exploit-db.com/

Full disclosure was a thing once upon a time, where exploits and proofs of concept were dumped publicly, forcing companies to fix the issue or be compromised. That's mostly been moved away from in favor of responsible disclosure, giving companies time to patch the issue before it's known publicly.

Maybe we should be moving back to full disclosure to force these companies to take data security seriously. Or at least then we could point to a known vulnerability as proof the company is shitty and is neglecting their infrastructure.

[–] LiveLM@lemmy.zip 72 points 20 hours ago* (last edited 20 hours ago) (1 children)

Didn't think I'd ever side with no script kiddie but at this point fuck it.
If your company can't be bothered to do the bare minimum in security then yeah I hope the least skilled hacker ever comes along and wrecks it.

[–] adespoton@lemmy.ca 26 points 19 hours ago (1 children)

Thing is, with the latest frontier models, the least skilled person can find a crack in the most secure company around, as long as they can string a few sentences together.

It isn’t about “bare minimum” anymore. All it takes is a single lapse in vigilance from a single employee, and they’re in… and the LLM doesn’t have to pause to figure out what to do next.

[–] Damage@feddit.it 19 points 16 hours ago (3 children)

Pentesters have access to LLMs too

[–] Mika@piefed.ca 24 points 14 hours ago

some hacker unleashes malicious AIs to the internet, breaking it apart cause AI keeps finding vulnerabilities in everything and break things faster than humans can fix

corporates build corporate internet and the blackwall, which is AI to fight malicious AIs

Gooooood morning Night City!

[–] adespoton@lemmy.ca 1 points 7 hours ago

It’s easier to destroy a house than to build it.

[–] ByteJunk@lemmy.world 9 points 16 hours ago* (last edited 16 hours ago) (1 children)

Yeah, but an LLM's arms race isn't "doing the bare minimum in security", which is what the poster before was saying.

This is a genuine concern, where whoever has access to the best/most recent/most expensive models can unleash chaos - I'm talking state-sponsored attacks, mega-corp espionage, bored billionaires,...

[–] MagicShel@lemmy.zip 4 points 11 hours ago (1 children)

The people you listed were already doing this. The problem is Darrell, the guy who thinks Earth is flat, can also do this.

[–] ByteJunk@lemmy.world 6 points 8 hours ago* (last edited 4 hours ago) (2 children)

Meh. When you're expecting to have to defend against an army battalion, how much of a thread is Darrell the flat-earther and his AR-15?

Because if Darrell is doing damage, you've been conquered and didn't even noticed.

Edit: in case you're not following the thread and feel an urge in your loins to come defend Darrell, do note that I'm not disparaging the issues a dimwit with AI can cause. I'm pointing out that other players will have even larger sticks than your friend Darrell.

Case in point, Darrell will not have Claude Fable. Others will.

[–] minfapper@piefed.social 1 points 6 hours ago (1 children)

In this analogy Darrell fires an ICBM, because everyone has access to a ton of those for $20/mo.

The overall point is that doing (what used to be) the bare minimum is no longer even close to enough. To be considered adequate, you need super ironclad defense, because even low skilled attackers have access to very powerful weapons.

[–] ByteJunk@lemmy.world 1 points 3 hours ago

You said so yourself, everyone has a ton of those.

Darrell is firing an ICBM at a place that is being hit with hypersonic hydrogen bombs all the time. Either he's hitting rubble, or a damn impressive defense that he's unlikely to break.

[–] adespoton@lemmy.ca 1 points 7 hours ago (1 children)

With AI as the army battalion, Darrell becomes a general.

[–] ByteJunk@lemmy.world 1 points 3 hours ago

Sure, in a world where the big boys have Death Stars.

[–] pennomi@lemmy.world 13 points 20 hours ago (1 children)

Only for a year or so. Any company still vulnerable after these tools have been out long enough deserve it.

[–] beveradb@sh.itjust.works 14 points 18 hours ago (3 children)

Most people on lemmy seem to condemn use of LLMs in any way for anything, I wonder what those folks opinion of this stance is - should companies use the tools or not?

[–] marzhall@lemmy.world 3 points 9 hours ago (2 children)

Finding holes in software has employed "fuzzing", where you send completely random payloads, as a research tactic for quite a while (and it has found exploits). LLMs just seem like "educated" fuzzing, I don't see why anyone would complain about updating your suite with them.

[–] borari@lemmy.dbzer0.com 2 points 4 hours ago* (last edited 4 hours ago)

I’ve been fucking around with using Claude to solve CTF challenges. I’m using a harness built out of a custom agent I wrote that progressively loads specific a specific skill for the challenge category, cryptography, binary exploitation, reverse engineering, forensics, etc.

It’s solving the simple shit in <1m using sonnet. It’s solved some shit that I couldn’t figure out at all during the CTF in the time limit we had in ~20 minutes. There’s been 2 challenges that after about 25 minutes I’ll kill the agent working on it, change to opus, then opus solved them in about 20m. One crypto challenge was so math heavy i never would have figured it out. One bin exp challenge didn’t provide a local binary, everything was remote. There was a catch that I never would have solved bc it was remote only and I couldn’t locally debug it.

It’s fucking scary good at solving these things. I just prompt with “use to solve ./category/challenge/“ and it fully just does everything. It’s definitely akin a fuzzer that can be used for way more than just finding crashes and memory leaks. It takes some work and understanding to make it context/token efficient I think, but it lowers the bar so tremendously that I definitely see why there’s concern here. And again it’s solving most of these things with sonnet, not even opus and definitely not fable.

All told, this feels like the same panic that happened when metasploit first got released/demo’d at defcon back in the day.

[–] ozymandias117@lemmy.world 1 points 4 hours ago

As long as they produce a PoC like fuzzing tools, I don't think anyone is complaining

It's the theoretical attacks that nearly always turn out to be impossible, wasting time, and making it harder to find the real issues that need investigation that's the problem with slop reports

[–] village604@adultswim.fan 14 points 18 hours ago (2 children)

Cybersecurity is actually one of the few fields that can benefit from AI. There are companies like Horizon3 who are using it alongside their other threat models to do continuous pen testing.

[–] Chronographs@lemmy.zip 11 points 17 hours ago (1 children)

Yeah imo the one thing ai is legitimately useful for is finding answers to difficult problems that can be trivially verified as correct.

[–] MalReynolds@slrpnk.net 3 points 15 hours ago

In this case hallucinations actually help...

[–] Duke_Nukem_1990@feddit.org 0 points 14 hours ago (1 children)

Gonna take a guess here that what is used in cybersecurity is not LLMs but one of the more useful machine learning applications. Just a nitpick cause today "ai" and "LLM" are sadly synonymous.

[–] boonhet@sopuli.xyz 8 points 13 hours ago (1 children)

No, LLMs can definitely be useful for cyber too. It's the whole reason the US government banned Claude Fable for export.

An LLM can not just try existing exploits like a script kiddy, but with iteration it can try variations and if you know what runs on the server, inspect the source for potential exploits.

They can also look at your setup and say what issues they see (reverse proxy config, etc).

Doesn't replace an expert, but can be useful for a first pass before you get the highly paid people involved.

[–] Duke_Nukem_1990@feddit.org 2 points 13 hours ago

You know what, fair enough. I don't know enough about that particular one.

[–] DeadDigger@lemmy.zip 3 points 17 hours ago (1 children)

Well the problem is that for example curl got flooded with generated security reports where only 5% had some true security potential. So your llm will basically flood you with false positives

[–] ByteJunk@lemmy.world 4 points 16 hours ago (1 children)

If 5% of the reports are genuine security vulnerabilities that they wouldn't have found otherwise, that's looking like a big win to me, not sure how you see it differently.

[–] frongt@lemmy.zip 1 points 16 hours ago (1 children)

The problem is identifying which 5%. Nobody wants to filter that much AI slop.

[–] AwesomeLowlander@sh.itjust.works 7 points 16 hours ago (3 children)

If you're working for a company's cybersec, that's your job. And a much preferable one to waiting for an attacker to do it for you.

[–] borari@lemmy.dbzer0.com 2 points 4 hours ago

If you’re submitting a vulnerability to a public repo, that’s also your job. These slop reports that are wasting maintainers time should never have been reported. The person tasking the LLM is out of their depth and can’t be the human in the loop that verifies the vulnerability report before submitting because they don’t have the required knowledge to do that. It’s a shame, because if people who had the requisite knowledge were the ones submitting, the ratio of valid reports to noise would be way higher than 5% and open source maintainers wouldn’t be feeling burned the fuck out.

[–] frongt@lemmy.zip 1 points 5 hours ago

Sure, but nobody wants to do that, even at fair pay. Unpaid open source volunteer projects REALLY don't want to do that, and risk burning out what is typically a solo main dev.

[–] ByteJunk@lemmy.world 4 points 8 hours ago

Exactly. If you go through 100 tickets and find 5 real vulnerabilities to patch, that sounds incredibly good...

[–] minorkeys@sh.itjust.works 0 points 17 hours ago

Only if you're stuck in the past.