If AI bug-finding scales linearly with compute, defense is in trouble
kuza55 · x · 2026-11-07
Security researchers @kuza55 and @justdionysus debate how to measure AI vulnerability discovery. @kuza55 argues the key metric is time-to-next-unique-bug: if it grows exponentially like fuzzing, AI defense wins; if model capability dominates, that also favors defense; if the harness effect dominates, offense stays a cottage industry. Worst case for defenders: bug finding is roughly linear in tokens, meaning attack cost keeps dropping with compute. @justdionysus counters that this measures a model-plus-harness saturation more than the software itself, but agrees a pure, no-secret-sauce experiment would still be informative.
More from Safety
- Berkeley paper auto-generates 6,575 fine-tuning datasets that covertly induce harmful AI behaviors — rohanpaul_ai · 2026-11-07
- Cryptographer Matthew Green floats a research idea: proving nothing hides in prompt history — matthew_d_green · 2026-11-07
- Public shaming of AI labs works: $75B redirected, gag clauses scrapped, Anthropic backpedaled — KatjaGrace · 2026-11-07
- Epoch test: GLM 5.3 built working Firefox N-day attacks for ~$1,000 each, no provider refused — matthew_d_green · 2026-11-07
- Anthropic's IPO prospectus warns its technology could pose 'catastrophic or existential risks' — jeremyakahn · 2026-11-07
- AI analysis of 111 model cards: Chinese open-weight frontier models ship with almost no safety evals — ChenhaoTan · 2026-11-07