LLM agents vs Apache security: long CVE tail helps, but adversarial pressure is irreplaceable
jd_pressman · x · 2026-10-31
On the topic of AI agents auditing open-source software, the author argues Apache — a piece of software literally named after how often it needed patching — is surprisingly good from a security standpoint, thanks to the long tail of bugs already fixed versus a fresh rewrite.
He admits he didn't ask LLMs to hunt zero-days in it, and stresses that walking an agent through past CVEs isn't enough: there's no substitute for adversarial pressure.
More from Safety
- NVIDIA discloses Brev platform breach: SSH keys exposed Oct 4–20 — HowDevelop · 2026-10-31
- Flock surveillance cameras reappear in Dayton, Minnesota after city voted to cancel contract — Polymarket · 2026-10-31
- Northflank hacked: users told to rotate all secrets as AI keys confirmed abused — basedjensen · 2026-10-31
- OpenAI Publishes 'Fair Use Benefits Everyone' Amid Copyright Fight — pentagrama · 2026-10-31
- Digital tax by traffic raises privacy questions; Apple's content caching would neatly dodge it — ngxson · 2026-10-31
- Happy Friday: One HN Front Page Full of AI Backdoors and a $6.3B Binance Hack — flngr · 2026-10-31