[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <afDLFWVMK-r70PB0@yuggoth.org>
Date: Tue, 28 Apr 2026 14:58:29 +0000
From: Jeremy Stanley <fungi@...goth.org>
To: oss-security@...ts.openwall.com
Subject: Coordinated Disclosure in the LLM Age
As I'm sure is the case for everyone, the projects I work in are
under a seemingly unending deluge of vulnerability reports from
researchers using LLMs to mine for security gold in our software. At
the same time, we see maintainers on our projects relying on
LLM-oriented tools to develop fixes for vulnerabilities and compose
prose for advisories.
While I take a moment to catch my breath, this new Bizarro World
we're all living in has gotten me thinking about the risks of public
LLM services to embargoed vulnerability handling workflows and
traditional coordinated disclosure. The operators of these LLM
services are known to feed prompts and results back into their
training data, presumably making it faster and easier for the same
information to be found later by other users of the same service.
Would keeping embargoes short help to mitigate related risks of
parallel rediscovery or outright disclosure to other LLM users? It
seems to me that there must be some inherent lag in this process,
but how much?
I'm sorely tempted, both due to the increased volume and the risk of
premature disclosure, to just assume that any vulnerability reported
as a result of research using an LLM is trivially discoverable by
others, and give up trying to pretend there's any point to working
it under embargo. Similarly, it makes sense to me that patch
development and descriptive prose shouldn't be produced with LLM
assistance for any vulnerability that is being worked under an
embargo.
I can't be the only one whose been pondering this... what positions
have the rest of you taken?
[P.S. No LLMs were exploited in the making of this message.]
--
Jeremy Stanley
Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
