oss-security - Public security analysis and LLM-assisted variant discovery

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <19e19d71894.80289f98195045.3101805823226928719@roiai.ca>
Date: Mon, 11 May 2026 18:39:47 -0700
From: Tim Shephard <tim@...ai.ca>
To: "oss-security" <oss-security@...ts.openwall.com>
Subject: Public security analysis and LLM-assisted variant discovery

Hi all,

I wanted to raise a process concern around detailed security analysis in public bug records, code reviews, commit messages, and advisories.

I have been using LLM-assisted review across these sources to find real vulnerabilities, and one thing that has become clear is that this material is increasingly useful for finding variants, regressions, and related insecure patterns. Even after a specific bug is fixed, detailed reasoning about exploitability and nearby security sensitive code paths can remain valuable to attackers.

I am not arguing against thorough security analysis or useful public advisories. I am suggesting we distinguish between public impact/fix guidance and deeper security analysis that may be better kept in restricted channels.

I realize this cuts against some disclosure norms, but I think AI-assisted variant discovery changes the tradeoff enough to merit discussion.  

Cheers,

Tim
Confidential communication. No warranties or commitments unless in a signed agreement. If received in error, notify sender and delete. Unauthorized use prohibited.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.