AI-written Apache clone's bug hunt drags on; author admits no idea when it converges

jdpressman is running an ongoing experiment: pitting AI models adversarially against vapache, an Apache implementation he wrote with AI. Bugs keep surfacing—mostly long-tail logic errors in the Apache2 ACL semantics implementation—and he has no idea when this bug hunt will ever converge, which is exactly what scares him most. vokaysh suggested hardening guided by threat intelligence, referencing CISA's Known Exploited Vulnerabilities catalog.

Confirmed

• The adversarial model in the experiment is DeepSeek 4.1 Flash, instructed only to find bugs in vapache itself; dependency libraries and the underlying Linux environment are out of scope, since that isn't the experiment's focus.
• jdpressman explained that the endless stream of bugs doesn't mean the model is getting dumber—what's really happening is that the long tail of logic errors in the Apache configuration access control list (ACL) semantics implementation keeps growing longer.
• Many bugs come from fuzzing against real Apache2 as an oracle, which he believes proves the problem is in principle convergable and solvable.
• Fallback options: at minimum, align with real Apache2 ACL logic by definition; if true security can't be achieved, support only a subset of Apache2 configurations, or switch to doing nginx.
• vokaysh proposed "threat-intelligence-guided hardening" and shared CISA's Known Exploited Vulnerabilities catalog for reference.

Unconfirmed

• When bug fixes for vapache will converge: faced with the claim that "running enough tokens will reach a secure steady state," jdpressman admits he has no idea when the bugs can be fully fixed—and that's precisely what unsettles him most.

Why it matters

• This experiment directly tests the question "can complex system software written by AI reach a secure steady state?" With no end in sight for the bug tail, it's a warning sign for practices that rely on AI to generate security-critical code.

2026-10-28 ~ 2026-10-28 · 7 related posts

• Threat-intelligence-guided hardening: CISA KEV catalog as the fix for endless AI-written bugs — jd_pressman · 2026-10-28
• vapache bug flood is a long tail of logic errors in Apache ACL semantics, not model dumbness — vokaysh · 2026-10-28
• vapache fuzzing scoped to its own logic bugs, excluding dependencies and OS layer — jd_pressman · 2026-10-28
• Using DeepSeek 4.1 Flash as the adversary model to fuzz vapache for vulnerabilities — vokaysh · 2026-10-28
• [source] Fuzzing an AI-written Apache clone: author admits he has no idea when the bug flood ends — jd_pressman · 2026-10-28
• [source] Fuzzing vapache against Apache2 as oracle keeps surfacing a long tail of logic bugs — jd_pressman · 2026-10-28
• [source] vapache author: parity with Apache2 ACL is possible in principle, or ship a subset — jd_pressman · 2026-10-28