Public datasets of CVEs being underwhelming doesn't mean much if all of the issues are in private company codebases that will never get a CVE number assigned and will never get a fancy blog post. You're never going to hear about them, and the people working on them probably can't tell you about them, but that doesn't mean they don't exist.
We're all worried about OSS having security issues because of how widely used things like PHP or curl are... but the same can be said about email providers, document collaboration SaaSes, payment processors, etc that millions of companies depend. Those companies will never be in datasets like this, and they'll never publicly disclose how many issues they found.
Agreed. My fairly obscure company got hit by something like this last weekend. What stood out was the speed: attackers found something small, used it to uncover something else, and pivoted to clever exploits for the new thing within minutes. It hit a dozen of our apps in parallel within the span of a day, from a rotating pool of residential proxies, Tor, GCP and Cloudflare IPs.
I'm fairly confident it was LLM-driven. The payloads and throwaway accounts had names like "PT59553 TEST IGNORE" and "PocCorp1659r2", and it adapted to error messages the way a person reading them would, just never sleeping. A non-tech company with 100x the surface area and much more valuable data could be in big trouble.
Of course I used LLMs for the defense too, and they were amazing at log forensics and fixes. The annoying part was when I asked Opus 5.5 for clear repro cases of exactly what the attackers did, I hit the cyber safeguards. Opus was trying to keep the exploits for my own bespoke applications away from me. It was happy to fix things of course, but I worry if it really can't 'think' about actual exploits, its fixes will be less informed.
billion dollar companies are not exempt from this, in fact they tend to be the worst offenders
https://www.controleng.com/throwback-attack-hackers-attempt-...
https://esemag.com/water/russian-hackers-breached-quebec-wat...
https://www.cbsnews.com/news/us-water-systems-cyberattacks-i...
https://www.bbc.com/news/world-us-canada-55989843
edit: formatting urls
Airgaps don't solve everything either. Stuxnet was successful at destroying air-gapped machines.
I suspect open source projects are better off than proprietary software - they already have many eyes on them, whereas commercial software that’s not a prominent and profitable target (e.g. windows, ios) hasn’t had much attention until LLMs made attacking them significantly easier
Worse is everyone is like "Well, this stuff is protected or air gaped". Yea, it's behind firewall, or even private networks commonly, but the moment you get inside that network you have tons of lateral movement and could cause unbelievable damage in minutes.
This has been disproven by the sordid history of OpenSSL. It was open source, critical, and full of holes.
https://www.mend.io/blog/how-the-heartbleed-vulnerability-sh...
> Not maintained or developed by a billion dollar company.
They shouldn't. AI is great at some things and underwhelming at others, and it's never predictable if you're going to get the great response or the silly one and when you'll get it and over what topic. And you and the author combined are illustrating one scenario where that jaggedness shows up.
Make sure you’re still thinking.