Hey world, we created this problem, and it will hurt all of you whether you use it or not. The good thing is there is a solution: if you pay us a lot of money we can try to fix it. The only problem is you’d better hurry because we are releasing the dangerous stuff as fast as we can so you’d better pay us to put the safety measures in place because we are the only people that can fix it and time is running out because, like I said, we are moving fast.

So how many tokens can I put you down for.

> How can we help identify and fix vulnerabilities in downstream packages while upstream fixes are pending, or backport fixes to older versions that no longer receive security updates?

Is the company selling a magical code generation machine really asking how it can backport a fix to an older version of the same software?

Is this for real?

It seems like OpenAI are trying to frame this as if AI did all the work here, but it's not really true given what Calif say (https://calif.io/php2shell/):

> How did we find this?

> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.

> There are some practical research implications here. LLMs may have ingested public historical vuln data, but in their default variant analysis tends to move from the newest and most prominent bugs toward nearby older code. They do not reliably begin with obscure twenty-year-old exploitation primitives. Keeping your own mental catalog of a target's vulnerability history lets you prompt that direction explicitly.

The commit $1 billion in tokens to "defenders". $1 billion directly to QA for open source projects [1] which would write 100% code coverage, run ASAN and fuzzers would be more effective.

But of course there would be no marketing.

[1] From whom you stole everything in the first place.

The first sentence of "Coordinating a global response" is "Getting a fix into use can mean adapting it for older releases"... but I guess they mean "only supported releases", as the fixes only go back as far as 8.2, which still has security support until the end of the year, but nothing for 8.1 or 8.0, and in the case of PHP there are still plenty of PHP sites on 7.x and even 5.6.

I wouldn't expect the PHP team to provide patches for versions for which security support has ended. But this seems like the kind of task that AI is especially well suited for-- rework the patch for a release that is no longer supported but still widely used. It would've been nice for people who have much older sites to be able to patch their PHP rather than have to upgrade PHP as well to get the fix.

> Patch the Planet

I'm sure they named it after the "Hack the planet" slogan from the Hackers movie.

So much fluff and marketing from every group.

Just give us the damn code to verify things are working since so many have to use stopgap solutions and want to verify them

Is there a sister site? perhaps https://stop-deploying-public-facings-services.com or https://dont-build-more-software.org?

I would simply write code that doesn't have vulnerabilities in the first place.

l'IA est simplement un outils ce sont les ingénieurs derrière qu'ils faut féliciter pour leur travail acharné.

This thread contains an enormous amount of negativity that just doesn't make sense here. OAI are giving developers and security researchers access to AI models so they can check their software for vulnerabilities. What's the problem? Sure, there's marketing around the success stories.

Some people are acting like this is only a problem because labs are releasing models that can find and exploit these vulnerabilities in the first place. This is a nonsense claim. Humans have been discovering vulnerabilities and privately weaponizing exploits just fine for decades. We are collectively raising the floor for security.

If you're using Dependabot, we built a service that automatically analyses, fixes broken checks, and (optionally) auto-merges Dependabot PRs for you so this type of update can land automatically.

Check it out: PatchWave (https://patchwave.ai)

(Disclosure - I am a co-founder)

> Emergency patching. When, if ever, should governments or other operators use a vulnerability to patch systems they own or are authorized to manage after losing administrative access? What safeguards should apply? We can imagine an end-state of internet-wide always-on scanning for known vulnerabilities, and either notifying site owners when one is detected or patching the system.

The wild stuff is at the end. They propose someone (who?) auto-patching even systems they don't own.

I am shocked that they are releasing a skill to check the php version.

Who cannot type "php --version" but can use skills?

Did they actually do anything good here ? Is this really marketing in the middle of this shitshow ?

We enabled the disease and provided the vaccine!

This is an insult to actual security researchers and engineers. What a bunch of nonsense words.

OpenAI consistently doesn't know what they're talking about.

Patch the Planet? Not with OpenAI tools.

How much time will be left in the Defender’s Window between now and an organization getting Daybreak Access?

Feels like a marketing campaign lol

In 2024 I saw a reddit post answering the question: AI is going to program insert name App.

Response: "What's the prompt?"

Yep. I might take minimum wage interns and make million dollar software(or million dollars in 2023), but they often run into issues that a 5 minute review with me solves.

I do wonder if AI is going to eliminate prompt engineering... It's basically all I have left. I feel like I have magic words.