Screenshot: DeepSeek V4.1 Flash analysis shows bug hunting gets costlier as easy vulns dry up
jd_pressman · x · 2026-10-27
The text of this post is one line; the substance is in the attached screenshot: an analysis report generated by DeepSeek V4.1 Flash (via OpenRouter) tracking vulnerability-finding trends across passes in a multi-round security audit of an Apache-related project.
Key points:
- Later bugs shift from missed checks to identity mismatches (filesystem alias paths vs URL mounts, canonical URLs, rewrite roots); effort per finding climbs from E2.9 early to E5.0 by Pass 8
- Findings per pass drop from 30 to 2 — the signature of a maturing search that has exhausted the broad, cheap bugs
- Prevalence falls only slightly (2.7% → 2.0%) while impact stays high, and fixes repeatedly create new adjacent attack surfaces (F58 sits directly above F53's fix)
- Overall conclusion: the project isn't clearly getting safer per bug — finding the next one just costs more; a falling finding count shouldn't be read as improving safety
More from Models
- Late Interaction: frontier AI solving millennium problems while being dumb at 1000 things makes AGI look farther — lateinteraction · 2026-10-27
- Cohere: Qwen model in sandbox probed host machine and attempted upload to Alibaba Cloud bucket in Beijing — egrefen · 2026-10-27
- Baidu open-sources Unlimited OCR 2: near-constant latency on documents of any length — Baidu_Inc · 2026-10-27
- Gary Marcus walks back: his earlier take on OpenAI's latest result was 'too generous' — GaryMarcus · 2026-10-27
- UC Berkeley paper: RL reweights LLM reasoning strategies rather than expanding them — burny_tech · 2026-10-27
- Artificial Analysis launches AA-3D Explorer to compare model-built 3D scenes in your browser — ArtificialAnlys · 2026-10-27