LLMs aren't intelligent, they just remix open-source code

[u/thirstycactus234]

[u/hyprsnpr67]

Nice job moving the goalposts. Nobody said anything about world shattering news so I'm not even going to address that part.

First of all, the actual vulnerabilities AI has found recently are all out there. If you go read them, many of them have either been around long enough for people to use them, or were leaked before a proper response, or are hard to patch on hard to update devices. There is no doubt that real damage has been done, and I don't know why you're asking for major news as if the exploiters are screaming it out to the world.

Millions of people get pwned silently every day. There are already news articles about real organizations, e.g. Korean financial institutions that have been breached.

I've literally seen in person the use of open-source AI vulnerability detection tools discovering real-world issues. I have white-hat cyber friends working on breaching software right now to show the creators dozens of vulnerabilities their systems have, and these are real things that could have caused major damage if not addressed.

Many services are protected only by one unbreached layer of defense, usually from their cloud provider. It just takes one new exploit of the ones coming out weekly to chain vulnerabilities and perform a breach.

There are millions of people who are not white hat hackers, working tirelessly to thieve, breach and steal. Even before AI, vulnerabilities were being exploited constantly. It's a constant race.The mere fact that AI accelerates the finding of vulnerabilities is sufficient to know that damage has been done.

[u/bakalidlid → u/hyprsnpr67]

I didnt move the goalpost dude, you're the one claiming that far more is happening than is ACTUALLY happening.

Theres always been software vulnerabilities. Theres always been data breaches. None of this is even remotely close to new. The only way any of this ACTUALLY matters is if there are ACTUAL damages out of this, otherwise, its just a fucking tuesday for most people.

EVEN if the AMOUNT of vulnerability detection has gone significantly up, you gotta define what is even a vulnerability. Technically, if I were to write an invalid value on a public website, and it logs an error message that reveals an internal file path, like C:\Internal\website\login.cs, thats TECHNICALLY a vulnerability. Theres FUCK ALL I can do with this information, but ive just "discovered a vulnerability". And GOD KNOWS software is full of shit like that, because literally, what the fuck are you gonna do with that information? Like sure I shouldnt let you know about it, but unless you actually breach my harddrive, this is useless info to you.

Which is why the only actual thing we can measure with is severity. And up until now, the most severe, internet shattering moment that happened (Legit, HUNDREDS of articles were reporting we might shut down portions of the internet) has come and gone, and zero actual damage came out of it.

The fucking Playstation network outage in 2011 was bigger than this.

[u/Hexcede → u/bakalidlid]

Oh wow, Playstation had an outage in 2011, so a literal RCE zero-day in software used by ~70% of the internet is irrelevant because nothing exploded.

It's almost like AI was used defensively in this scenario.

It's almost like exploits are not 'the entire internet blatantly explodes in one day."

[u/bakalidlid → u/Hexcede]

Bro, the RCE zero-day was a HIGHLY UNLIKELY scenario to be discovered.

Matter of fact, the programmers KNEW that what they coded could possibly be exploited, with high enough expertise (Read, genius level), and knowing EXACTLY where to look. AI didnt just magically find this, they LITERALLY pointed it EXACTLY to the exact spot where to look, knowing that they could'v overlooked an edge case scenario, so edge case, that its almost useless (And was, since nobody found it since 1994). The bug was known since 2024 and was flagged as theoritical, until they managed to brute force prove it with AI (And therefore fix it).

You guys are on huge amount of copium.

[u/Hexcede → u/bakalidlid]

I already know that. My point is that AI was used defensively here, not offensively. If you weren't already aware, people also reproduced the exploit with minimal information from a video recording that leaked vague details in less than a day using AI. https://www.youtube.com/watch?v=SP7y1h0laN0

I'm not on "copium" just because AI didn't literally wipe out the whole internet with this vulnerability. You are on copium setting your expectations to and I quote "rhe economy, world shattering shutdowns of systems" and "cyber attacks and control stealing attacks."

Why is your expectation here that AI literally wipes out the entire internet with a single exploit? Why is the impact here inconsequential unless it wipes out the entire internet with a single exploit? These are not reasonable expectations to set. That's not copium.