Seven months into Project Glasswing, VulnCheck has tracked 442 CVEs attributable to Anthropic, roughly 0.5% of all CVEs published this year, with only two identified as exploited in the wild. Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been marked fixed.
Can anybody please explains it to a cybersecurity layman such as myself why that is? Did AI just exaggerate how serious those exploits are? Did it hallucinate the exploits whatsoever? Were the exploits uninteresting in the real-world hacking, where the human is still the weakest link?
If I ask an LLM to review my code it will find a long list of issues. Some of them will be real, and some of them will look kind of like issues, but won’t really be when you dig into them. Sometimes the issues will be kind of real, in the sense that there’s a real best practice not being quite followed, but they don’t actually rise to the level of a bug or vulnerability, and they’re not worth fixing.
If I fix that first list of issues, then ask an LLM to review my code again, it will, almost without fail, generate an equally long list of issues the second time. There might be some new real issues it missed in the first pass, but it will be much more slanted towards the “not quite a real issue” category, or duplicates of the “issues” I didn’t fix.
By the third round of review, almost everything it produces will be useless.
I’m pretty sure this is what’s going on with Project Glasswing.
The AI reviewer always says “approve with suggestions”. Code that is logically flawed: approve with suggestions. Typo in a comment: approve with suggestions.
But god forbid it deems my test coverage inadequate! “Don’t approve” 🫠
Can anybody please explains it to a cybersecurity layman such as myself why that is? Did AI just exaggerate how serious those exploits are? Did it hallucinate the exploits whatsoever? Were the exploits uninteresting in the real-world hacking, where the human is still the weakest link?
If I ask an LLM to review my code it will find a long list of issues. Some of them will be real, and some of them will look kind of like issues, but won’t really be when you dig into them. Sometimes the issues will be kind of real, in the sense that there’s a real best practice not being quite followed, but they don’t actually rise to the level of a bug or vulnerability, and they’re not worth fixing.
If I fix that first list of issues, then ask an LLM to review my code again, it will, almost without fail, generate an equally long list of issues the second time. There might be some new real issues it missed in the first pass, but it will be much more slanted towards the “not quite a real issue” category, or duplicates of the “issues” I didn’t fix.
By the third round of review, almost everything it produces will be useless.
I’m pretty sure this is what’s going on with Project Glasswing.
Oh, OK. So an incompetent vuln discory and remediation cycle.
Oh no. We meant to create an automated engineer, but we’ve instead created an automated producer. https://www.simplethread.com/looks-great-lose-the-duck/
This is very true, and hilarious to me.
The AI reviewer always says “approve with suggestions”. Code that is logically flawed: approve with suggestions. Typo in a comment: approve with suggestions.
But god forbid it deems my test coverage inadequate! “Don’t approve” 🫠
Got it, thanks!
Machine build to steal and plagiarize steals and plagiarizes. Shocked pikachu