LLMs can spot incomplete fixes in shipped patches, OAIC 2026 talk shows
dyn___ · x · 2026-10-25
- Aaron Grattafiori (Umbriel AI) presented a 25-minute offensive security talk at Offensive AI Con 2026: "I Know What You Didn't Fix Last Summer."
- Core thesis: the next vulnerability may hide in a patch that already shipped — fixes are often incomplete, and related bug variants frequently go unpatched.
- He demonstrates a practical pipeline where LLMs study a target's patch/fix history to uncover incomplete fixes and bug variants.
- Covers the full workflow: research, patch review, variant discovery, triage, and validation, with real-world lessons on cost and reliability.
The full talk video and updated post-conference slides are available from the conference.
More from coding & agent
- Garry Tan's Gstack trims 1k lines of old model scaffolding as it crosses 137k stars — garrytan · 2026-10-25
- Agents still bad at dependent types: their instincts skew imperative even when writing Lean — hargup13 · 2026-10-25
- LangChain's Harrison Chase teases enterprise answer to OpenClaw, offers early access — hwchase17 · 2026-10-25
- Catalogue of 48 programming languages designed for AI agents maps three competing camps — QuixiAI · 2026-10-25
- MCP Sage pipes whole codebases into Gemini 2.5 Pro for second-opinion code reviews — modelcontextprotocol · 2026-10-25
- LangChain founder: AI content studio now makes all our diagrams, videos and PPTs — hwchase17 · 2026-10-25