AI vuln discovery is correlated: two teams independently found the same php2shell bug via GPT
voooooogel · x · 2026-10-26
In a debate with Soareverix on AI cyber risk, voooooogel argues models find vulnerabilities in a correlated, not random, way. Example: php2shell—one group found the PHP bug, another heard about it, asked GPT to "find a bad bug in php," and found the exact same vulnerability.
- Models walk the vulnerability pool via CoT in a fairly mode-collapsed way, so attackers systematically converge on the same bugs.
- Defense must simply walk faster—which it can, since there's far more money in building things and pooling fixed costs than in tearing them down.
More from Models
- OpenAI Hands Out Near-Daily Usage Resets, $100-Tier Users Question the Strategy — haider1 · 2026-10-26
- Ternary 1.58-bit Nemotron 30B-A3B GGUF Runs 368K Context on 12GB GPU — pmttyji · 2026-10-26
- AI researchers lament models refusing vulnerability analysis of old PHP code despite 'use AI to defend' messaging — voooooogel · 2026-10-26
- Developer confirms models are systematically refusing Apache-related vulnerability requests — jd_pressman · 2026-10-26
- Dev shares $5,107 monthly AI bill: 10B tokens, DeepSeek cost $0.70 — cneuralnetwork · 2026-10-26
- Skipping eval checks means you're likely fitting benchmark biases and noise — antoine_chaffin · 2026-10-26