[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <afI-PPAr7EP8SEsu@1wt.eu>
Date: Wed, 29 Apr 2026 19:22:04 +0200
From: Willy Tarreau <w@....eu>
To: oss-security@...ts.openwall.com
Subject: Re: Coordinated Disclosure in the LLM Age
On Tue, Apr 28, 2026 at 10:18:08PM -0500, Jacob Bachmeyer wrote:
> On 4/28/26 09:58, Jeremy Stanley wrote:
> > I'm sorely tempted, both due to the increased volume and the risk of
> > premature disclosure, to just assume that any vulnerability reported as
> > a result of research using an LLM is trivially discoverable by others,
> > and give up trying to pretend there's any point to working it under
> > embargo.
>
> You are correct here: you should assume that any LLM will give a similar
> result to another person who asks a similar question. In other words,
> LLM-discovered vulnerabilities should be considered already publicly known.
I'm increasingly doing that myself already, and predicted the death of
embargoes a serveral months ago. Now I just remove unneeded details from
commit messages, merging and issue releases to keep users protected.
Embargoes now play against security, for all the time we don't act,
users stay exposed to anyone having the luck to find the same problem.
It's not a matter of the LLM's strength but a matter of determination
by the researcher who could simply run a small model several times
helping it dig further. Bigger models just find faster, but that only
counts for those seeking protection, not for those trying to attack.
Willy
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
