[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
<SYDP300MB26667061ADB844B47257481E70EE992@SYDP300MB266670.AUSP300.PROD.OUTLOOK.COM>
Date: Sun, 18 Oct 2026 18:43:03 +0000
From: Peter Gutmann <pgut001@...auckland.ac.nz>
To: Solar Designer <solar@...nwall.com>, "oss-security@...ts.openwall.com"
<oss-security@...ts.openwall.com>
CC: "shvedov@....com" <shvedov@....com>, "David A. Wheeler"
<dwheeler@...eeler.com>
Subject: Re: Proposal: Add separate
oss-security-vulnerability-reports mailing list (for AI vulnpocalypse)
Martin Steigerwald <martin@...htvoll.de> writes:
>I'd expect a wave of AI reports, but once they are fixed, these will not be
>reported again. Then maybe after using even better models and agents there
>might be another wave of more difficult to find issues that are reported. But
>then these are fixed as well.
This matches what I've experienced in discussions with other OSS authors using
AI to audit their code, what's coming in now with newer models, now that the
stuff that earlier models found has been fixed, is more and more obscure
issues that require extraordinary combinations of circumstances to trigger.
For example there was CVE-2026-92392 that required among other things at least
three planets to be lined up right, a certain level of sunspot activity, and
eddies in the earths geomagnetic currents before the issue became a real
concern.
Peter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
