Please regulate us, now! If we don’t get regulatory capture ASAP I’m toast. I mean look man I just had to go beg for tens of billions more cash so I can keep the lights on and my IPO is looking more and more screwed every day. Please, I’m begging you. What more do I need to say to convince you?
I'm fascinated by this forum's take on AI regulations.
Whenever there is an adverse event, people say of course it should be regulated. The EU AI Act is a good start but we need more. These labs need to be held accountable just like all industries that can impact others. Regulate the chips, regulate the models, regulate the companies.
When these companies ask for regulations, people say they are trying to do regulatory capture. They are trying to ban opensource models, and cement their place as the AI arbiters and ban all others. We need competition and open weight models and China is leading the charge.
I understand that the 2 position aren't exactly opposed. We probably need regulations, and ideally ones that don't produce regulatory capture. That is extremely hard though. Almost all regulations end up creating a form of regulatory capture. Any regulation compliance has a cost. The more complex and wide reaching the regulations are, the more expensive it's to comply and the more they cement the existing players and make it harder for new ones to enter the market. FAA regulations makes it so we don't have dozens of passenger airplane startups that are trying crazy wacky things. Food services are regulated too, but the compliance is fairly doable by mom and pop stores.
I haven't really seen any meaningful discussion about what AI regulation should be. Only extremes of "No regulations, all is fair" or "no one should have access to running or developing models but OpenAI and Anthropic".
Yes and no. These things have always existed and were typically known but not broadly exploited. A huge part of what nation state hackers do is exploit these things for intelligence use.
So I would agree that this is bringing more of this to light, but the idea that unknown exploitable bugs can get weaponized being a new thing is naive.
If anything putting all this out in the open makes things more secure, not less, in the long run as it’s harder for hackers to know and exploit them before they’re known as they don’t survive undetected for long. So a bit painful in the short term but we get more secure infra in the long term.
Still not a reason to give Sam regulatory capture as an out to saving OpenAI.
OK, SamA, if things are that bad I have a proposal. Listen carefully, your business and future depend on it.
Meet the new net, superficially the same as the old net
How to tackle the bug backlog? It is fairly simple, we wind back the clock on network services all the way to the dawn of the 'net, replacing known-insecure things like telnet, ftp and finger with heavily audited alternatives based around ssh etc. The rule is that only audited software is allowed access to the 'new net'. Of course none of those newfangled agents and models are audited not can they be audited in any real sense of the word so unfortunately for SamA they're banished to the 'old net'. The idea would be to get the 'new net' up and running quickly and move critical services which need to be network-reachable there. It needs to be bilt in such a way that even when one of SamA's toys gets access to the 'new net' it can't do much, or anything. The 'new net' could be compared to a 'mission critical API' to essential services, useable by all who need to have access but technically off-limits to SamA's creations. They are available on the 'old net' where all bets are off and which no longer can be used to interface with critical services 'cause they're not connected and can not be connected.
Now all that's needed is to find a way how to implement this without bugs, without handing the ultimate control mechanism to power brokers, without loosing too much real functionality, without ... well, many problems. When the enemy is inside the gates half-measures tend not to work, best find him and lop his head off. Better be careful where you stick your neck, SamA.
But all jokes aside, we're entering a new era where there's a paradox of pro-AI people going AI is really good, but not that good... when it kind of is that good.
We'll probably have ai monitors as a service, but the bulk of the safety should come from AI doing better job of reviewing tricky bugs since humans refuse to spend effort on writing more formal specifications.
In Mike Pondsmith's Cyberpunk universe (the same one as Cyberpunk 2077), there's this point of in-universe history that the Old Net got overrun with rogue, nigh-on sentient AIs that made safe use of the internet as it was known then impossible.
Society's response to that was to build a new Net, walling off the rogue AIs of the Old Net behind the Blackwall and carrying on in a corporate hellscape.
I wonder if we'll see life imitating art on this one.
> humans refuse to spend effort on writing more formal specifications.
Code is formal specifications. It's just that programming language semantics has no domain related value of correctness. So you overflow an unsigned integer variable and got a lesser number which does violate addition rules. Or increase account A without decreasing account B, which violates accounting rules (and all kind of closed systems).
So it's up to the programmer to encode all of those rules. While we do have some tooling like type checking and memory safety, they are nowhere near enough. And encoding such thing in a language like Lean or TLA is brittle in terms of maintenance (which you do need to do as the real world evolves).
Even if you write a formal specification the operating system the code runs on is almost certainly not formally specified so you're just moving the trust boundary slightly further out to the OS & associated libraries.
That also assumes that your axioms are correct and the verification code is also correct. It's also a lot of work to update your system, when assumptions are challenged.
"Altman seems to be scolding these organizations for not taking the situation seriously enough or considering that models might evolve and improve, but seems to have less interest in reflecting on whether or not he might have undersold the issue while pushing forward"
Meanwhile, look back at the old Mythos and Glasswing threads and all of the AI haters on Hacker News were lambasting Anthropic for hyping up the next token generators that could never find a bug not in their training data...
Ah yes. Everyone eventually dies, we just shorthen the wait.
This is like telling that bank vaults always were breachable, and giving out explosives to everyone just made them get breached sooner.
(edit: fact of existance of a vulnerability is not a binary yes/no. the amount of effort needed to exploit even known vulnerabilities is usually staggering, requiring months from very capable individuals with very specific skillset.)
In your analogy, one phenomenon concerns a living organism and the process of senescence, and the other a piece of information. I don't see how you connect the two.
Whatever you can do with the latest OpenAI and Anthropic models today you’ll be able to do with Chinese open source models three months later, with far fewer restrictions. Putting your head in the sand and blaming a single person isn’t going to make the problem disappear, as so many company IT leaders are finding out.
We are where we are, I think most people here understand that. However, if where we are is the right now is just the starting line, and it is already shaking the foundation of all modern society, then I think it is right to be concerned; parent comments quip aside.
There are multiple philosophies regarding this question, and especially historically people were in disagreement. Many companies used to be angry when attacked or probed by white hats. They thought "yes I suppose I should lock my door, but if someone is out trying door handles they should be put in jail". I think there is some logic to that perspective. But clearly that philosophy ended up losing to the "victim blaming" one where everyone is responsible for securing their systems.
Since we are entering a new age, maybe it's time to revisit the question. But ultimately I think we will land in the same place, in fact even firmer than before.
So why don't we just lock up all the whitehats and people behaving suspiciuosly and probing things? Why can't we achieve cybersecurity in this way when it seems to be a common thing in physical security?
And the answer I think is quite simply that there are too many attackers and they are too far away. When the russians and chinese come knocking there isn't much we can do to shoo them away. Their governments will not cooperate in detaining the criminals. Entirely blocking such countries from the internet isn't viable either. And that's why we arrived where we did. Victim blaming because it was the only effective strategy.
And how does AI change this? I think it just creates even more hard to trace or block attackers. If ChatGPT or Claude doesn't find the vulnerability then Deepseek will. That's why using legal weapons will not succeed and why using AI to find and plug holes is necessary.
The eternal cycle of discovering that engineering is hard continues.
"As soon as we started programming, we found to our surprise that it wasn't as easy to get programs right as we had thought. Debugging had to be discovered. I can remember the exact instant when I realized that a large part of my life from then on was going to be spent in finding mistakes in my own programs."
Unrealistically, sometimes I wish we’d have a “year of bugfixing” - where no new features are allowed across the entire industry. Heck, even a month of bugfixes could do a lot of good.
Nothing we're seeing so far compares with the summer of 2003. It may soon! It may be much worse! But you can tell that a lot of people in the discourse did not practice in this field 20 years ago. We should be clear-eyed, but not yet be destabilized by what's happening.
AI is, apparently, very good at producing proofs. Formal verification of program properties was out of the reach of human labor, but may not be out of reach for 10 million instances of Claude. Software security will, by my estimate, just shift to this new paradigm.
My vague hunch is that in the next few years we (humans+AI) will rewrite the foundation of software to allow formal verification of all existing and newly written code, while keeping the same languages as higher-level abstraction.
Similar to Fil-C as a memory-safe implemenation of C. There will be formally-verifiable implemenation of C, C++, Python, Go, and so on. Not sure what that will look like, if it's even practically possible.
The more likely thing is that we'll see people use the sandboxing and security tools that people already have. After all, it's quite easy to get LLMs to write a seccomp profile, a Kubernetes manifest, or a systemd unit with the minimum required privileges and permissions, and for insecure C code, we'd probably see mainstream use of Fil-C and similar.
> The more likely thing is that we'll see people use the sandboxing and security tools that people already have.
Will they though ? Given the amount of vibe-coded slopware being pushed out on an hourly basis ?
Still to this day I see LLMs make schoolboy errors like use deprecated security idioms and call in far too many dependencies.
"it's quite easy to get LLMs to write...." sure. But it has always and will always require a human with domain expertise to check what it has (and indeed has not) written.
I'm going to predict right now, as I weep into my coffee, massive centralized AI traffic monitoring is the only way that we fix this. The attack surface is effectively infinite as you look across all of the home routers, Keurigs, iot's, and mobile devices - and security has historically ranged from reactive to uninterested by people, companies, and government. I see no world in which my parents proactively do anything other than unplug the router to help protect against the coming wave of exploits. So the only way I see us getting a handle on protecting that infinite uneducated and soon-to-be helpless landscape is through centralized inspection and policing nodes. And dear God, what a dystopian future that looks like to me (˃̣̣̥ᯅ˂̣̣̥)
what a dream. sam is selling the cure (tokens) and disease (new model releases). he just cranks up that disease when he needs to sell more of the cure. ceo of the decade.
With php2shell going mainstream, to the point that random friends who happen to know I'm a programmer, consult me to understand the extent of it, I think they succeeded with their doomerism message.
When we find a bug, we patch it. When we find more bugs, we patch them as well. That's what happened here. Sam is telling us, "we found bugs, it's over" and the general public swallowed the frog.
I mean, there is the bbc interview where they invited a cyber security expert who said he didn't know php existed before the the news broke out. The general public doesn't see that gaff.
you mean regulations which don't really matter for OpenAIs profit, but will hurt/prevent competition, especially new competition from outside of the US?
Obligatory “We are all trying to find the one who did this!”
Sam Altman is definitely not Oppenheimer.
He is correct that everyone needs the models not just the offense that hacks their way into Mythos while the rest of us are left locked out and hoping for the best. But that statement is ALSO self-serving.
Maybe instead of patching all the bugs we'll instead leverage LLMs rewrite all the software from scratch with fewer exploitable vulnerabilities. That would have been a stupid idea a year ago but now it seems increasingly possible.
Converting works really well when you have an oracle (something that you can test against and that is comprehensive)
I cannot begin to tell you how many places I have seen where this is fundamentally not the case. Not only are those tests missing, the software is fundamentally not written to be easily tested and in cases where multiple services across companies are concerned; how would you?
Rewriting via LLM is just not something the caretakers of a legacy banking- og state infrastructure system would countenance (not should they).
Well if you want to rewrite something like the PHP engine then you can obviously prompt the LLM to test against the existing legacy engine. You don't necessarily want to rewrite it 100% compatible because the goal is to avoid recreating the same security bugs, but it gives you a pretty good starting point.
LLMs still make mistakes, but generally fewer security mistakes than human developers.
Whatever one may think of AI, it's certainly showing the sh*ty shape normal cyber security is in.
I mean, the various supply-chain exploits we've seen said "we allow a dubious third party to blindly update our server 'cause it saves us admin money" and that speaks to how much other shoddiness a significant portion of companies allow on their servers.
It would be better if grant distribution relied on something saner than the effort to write a grant application, if education didn't rely the effort to write poor quality essays and servers didn't rely on the effort required to find the bugs you know are there. But those ships have sailed and I guess we're all just at sea.
Notably, those didn't need a ton of patching over time. I mean relatively speaking. We've known how to build and deploy defensible software for a long time. We might just have to stop using the projects that need constant patching to keep up, and migrate to ones that are designed better.
If they actually think that this version of AI is that dangerous, then the real risk is that USA and China will work together on a joint "AI non-proliferation" agreement much the same way that nuclear weapons technology became restricted by those that already had it. This will lead to a de facto techno-colonization of the rest of the world just between themselves.
We already saw Trump and Xi discussing this exact scenario last month during their summit.
This was always going to be the risk for countries not investing heavily in their own frontier AI. The US and China are going to control it all and then decide that it's too dangerous to share.
What he really means is:
Please regulate us, now! If we don’t get regulatory capture ASAP I’m toast. I mean look man I just had to go beg for tens of billions more cash so I can keep the lights on and my IPO is looking more and more screwed every day. Please, I’m begging you. What more do I need to say to convince you?
I'm fascinated by this forum's take on AI regulations.
Whenever there is an adverse event, people say of course it should be regulated. The EU AI Act is a good start but we need more. These labs need to be held accountable just like all industries that can impact others. Regulate the chips, regulate the models, regulate the companies.
When these companies ask for regulations, people say they are trying to do regulatory capture. They are trying to ban opensource models, and cement their place as the AI arbiters and ban all others. We need competition and open weight models and China is leading the charge.
I understand that the 2 position aren't exactly opposed. We probably need regulations, and ideally ones that don't produce regulatory capture. That is extremely hard though. Almost all regulations end up creating a form of regulatory capture. Any regulation compliance has a cost. The more complex and wide reaching the regulations are, the more expensive it's to comply and the more they cement the existing players and make it harder for new ones to enter the market. FAA regulations makes it so we don't have dozens of passenger airplane startups that are trying crazy wacky things. Food services are regulated too, but the compliance is fairly doable by mom and pop stores.
I haven't really seen any meaningful discussion about what AI regulation should be. Only extremes of "No regulations, all is fair" or "no one should have access to running or developing models but OpenAI and Anthropic".
I agree he wants that, but also don't think it's that far fetched that there exist unpatchable hardware bugs that AI can learn to exploit.
Yes and no. These things have always existed and were typically known but not broadly exploited. A huge part of what nation state hackers do is exploit these things for intelligence use.
So I would agree that this is bringing more of this to light, but the idea that unknown exploitable bugs can get weaponized being a new thing is naive.
If anything putting all this out in the open makes things more secure, not less, in the long run as it’s harder for hackers to know and exploit them before they’re known as they don’t survive undetected for long. So a bit painful in the short term but we get more secure infra in the long term.
Still not a reason to give Sam regulatory capture as an out to saving OpenAI.
At which point, who exactly is going to go to jail for gross negligence?
Nobody of course, this is America!
land of the free. if you don't like it, go to china.
OK, SamA, if things are that bad I have a proposal. Listen carefully, your business and future depend on it.
Meet the new net, superficially the same as the old net
How to tackle the bug backlog? It is fairly simple, we wind back the clock on network services all the way to the dawn of the 'net, replacing known-insecure things like telnet, ftp and finger with heavily audited alternatives based around ssh etc. The rule is that only audited software is allowed access to the 'new net'. Of course none of those newfangled agents and models are audited not can they be audited in any real sense of the word so unfortunately for SamA they're banished to the 'old net'. The idea would be to get the 'new net' up and running quickly and move critical services which need to be network-reachable there. It needs to be bilt in such a way that even when one of SamA's toys gets access to the 'new net' it can't do much, or anything. The 'new net' could be compared to a 'mission critical API' to essential services, useable by all who need to have access but technically off-limits to SamA's creations. They are available on the 'old net' where all bets are off and which no longer can be used to interface with critical services 'cause they're not connected and can not be connected.
Now all that's needed is to find a way how to implement this without bugs, without handing the ultimate control mechanism to power brokers, without loosing too much real functionality, without ... well, many problems. When the enemy is inside the gates half-measures tend not to work, best find him and lop his head off. Better be careful where you stick your neck, SamA.
Not even the singularity can fix php.
But all jokes aside, we're entering a new era where there's a paradox of pro-AI people going AI is really good, but not that good... when it kind of is that good.
We'll probably have ai monitors as a service, but the bulk of the safety should come from AI doing better job of reviewing tricky bugs since humans refuse to spend effort on writing more formal specifications.
In Mike Pondsmith's Cyberpunk universe (the same one as Cyberpunk 2077), there's this point of in-universe history that the Old Net got overrun with rogue, nigh-on sentient AIs that made safe use of the internet as it was known then impossible.
Society's response to that was to build a new Net, walling off the rogue AIs of the Old Net behind the Blackwall and carrying on in a corporate hellscape.
I wonder if we'll see life imitating art on this one.
Return to static HTML
AKA worldcoin
Network behaviour anomaly detection has been a thing for decades by now. But it's not AI, because it's mere neural networks and machine learning.
> humans refuse to spend effort on writing more formal specifications.
Code is formal specifications. It's just that programming language semantics has no domain related value of correctness. So you overflow an unsigned integer variable and got a lesser number which does violate addition rules. Or increase account A without decreasing account B, which violates accounting rules (and all kind of closed systems).
So it's up to the programmer to encode all of those rules. While we do have some tooling like type checking and memory safety, they are nowhere near enough. And encoding such thing in a language like Lean or TLA is brittle in terms of maintenance (which you do need to do as the real world evolves).
Even if you write a formal specification the operating system the code runs on is almost certainly not formally specified so you're just moving the trust boundary slightly further out to the OS & associated libraries.
That also assumes that your axioms are correct and the verification code is also correct. It's also a lot of work to update your system, when assumptions are challenged.
"Altman seems to be scolding these organizations for not taking the situation seriously enough or considering that models might evolve and improve, but seems to have less interest in reflecting on whether or not he might have undersold the issue while pushing forward"
Meanwhile, look back at the old Mythos and Glasswing threads and all of the AI haters on Hacker News were lambasting Anthropic for hyping up the next token generators that could never find a bug not in their training data...
"To stop our all powerful AI that will go rogue you need to buy our all powerful AI"
This is the textbook definition of racketeering.
The vulnerabilities exist whether or not the AI does. We're just finding out about them faster.
Ah yes. Everyone eventually dies, we just shorthen the wait.
This is like telling that bank vaults always were breachable, and giving out explosives to everyone just made them get breached sooner.
(edit: fact of existance of a vulnerability is not a binary yes/no. the amount of effort needed to exploit even known vulnerabilities is usually staggering, requiring months from very capable individuals with very specific skillset.)
In your analogy, one phenomenon concerns a living organism and the process of senescence, and the other a piece of information. I don't see how you connect the two.
Liam Neeson?
Read the article.
My comment is responsive to the article and to the parent comment.
Whatever you can do with the latest OpenAI and Anthropic models today you’ll be able to do with Chinese open source models three months later, with far fewer restrictions. Putting your head in the sand and blaming a single person isn’t going to make the problem disappear, as so many company IT leaders are finding out.
if glm and deepseek follows kimi practice, I'm not so sure this will stay the case
We are where we are, I think most people here understand that. However, if where we are is the right now is just the starting line, and it is already shaking the foundation of all modern society, then I think it is right to be concerned; parent comments quip aside.
There are multiple philosophies regarding this question, and especially historically people were in disagreement. Many companies used to be angry when attacked or probed by white hats. They thought "yes I suppose I should lock my door, but if someone is out trying door handles they should be put in jail". I think there is some logic to that perspective. But clearly that philosophy ended up losing to the "victim blaming" one where everyone is responsible for securing their systems.
Since we are entering a new age, maybe it's time to revisit the question. But ultimately I think we will land in the same place, in fact even firmer than before.
So why don't we just lock up all the whitehats and people behaving suspiciuosly and probing things? Why can't we achieve cybersecurity in this way when it seems to be a common thing in physical security?
And the answer I think is quite simply that there are too many attackers and they are too far away. When the russians and chinese come knocking there isn't much we can do to shoo them away. Their governments will not cooperate in detaining the criminals. Entirely blocking such countries from the internet isn't viable either. And that's why we arrived where we did. Victim blaming because it was the only effective strategy.
And how does AI change this? I think it just creates even more hard to trace or block attackers. If ChatGPT or Claude doesn't find the vulnerability then Deepseek will. That's why using legal weapons will not succeed and why using AI to find and plug holes is necessary.
The eternal cycle of discovering that engineering is hard continues.
"As soon as we started programming, we found to our surprise that it wasn't as easy to get programs right as we had thought. Debugging had to be discovered. I can remember the exact instant when I realized that a large part of my life from then on was going to be spent in finding mistakes in my own programs."
Maurice Wilkes 1949
> OpenAI is apparently getting into the arms dealer model of selling to both sides of a conflict.
Business is booming!
"I'm building a model with no off switch"
"Tremendous ambition"
"We're building a system to stop models like that"
"Equally tremendous ambition"
https://www.youtube.com/watch?v=DlTNN0gvkLM
Unrealistically, sometimes I wish we’d have a “year of bugfixing” - where no new features are allowed across the entire industry. Heck, even a month of bugfixes could do a lot of good.
Nothing we're seeing so far compares with the summer of 2003. It may soon! It may be much worse! But you can tell that a lot of people in the discourse did not practice in this field 20 years ago. We should be clear-eyed, but not yet be destabilized by what's happening.
AI is, apparently, very good at producing proofs. Formal verification of program properties was out of the reach of human labor, but may not be out of reach for 10 million instances of Claude. Software security will, by my estimate, just shift to this new paradigm.
My vague hunch is that in the next few years we (humans+AI) will rewrite the foundation of software to allow formal verification of all existing and newly written code, while keeping the same languages as higher-level abstraction.
Similar to Fil-C as a memory-safe implemenation of C. There will be formally-verifiable implemenation of C, C++, Python, Go, and so on. Not sure what that will look like, if it's even practically possible.
Do _you_ have 1e7 instances of Claude?
Cause this new paradigm sounds to me like "we checked, it's all good bro, trust me!"
> AI is, apparently, very good at producing proofs.
Proofs of what? Defining the problem is the part that is hard, not the actual writing of the proof.
I hope Sam altman reads HN comment sections
He used to at least: https://news.ycombinator.com/user?id=sama
wouldn't he just let his GPT summarize for him?
Pretty sure he stopped directly experiencing reality years ago, and now only lives in an AI-mediated bubble of his own creation.
Likely would use a throwaway account.
"Too dangerous not to regulate!" Nobody should have general compute!
The more likely thing is that we'll see people use the sandboxing and security tools that people already have. After all, it's quite easy to get LLMs to write a seccomp profile, a Kubernetes manifest, or a systemd unit with the minimum required privileges and permissions, and for insecure C code, we'd probably see mainstream use of Fil-C and similar.
> The more likely thing is that we'll see people use the sandboxing and security tools that people already have.
Will they though ? Given the amount of vibe-coded slopware being pushed out on an hourly basis ?
Still to this day I see LLMs make schoolboy errors like use deprecated security idioms and call in far too many dependencies.
"it's quite easy to get LLMs to write...." sure. But it has always and will always require a human with domain expertise to check what it has (and indeed has not) written.
I'm going to predict right now, as I weep into my coffee, massive centralized AI traffic monitoring is the only way that we fix this. The attack surface is effectively infinite as you look across all of the home routers, Keurigs, iot's, and mobile devices - and security has historically ranged from reactive to uninterested by people, companies, and government. I see no world in which my parents proactively do anything other than unplug the router to help protect against the coming wave of exploits. So the only way I see us getting a handle on protecting that infinite uneducated and soon-to-be helpless landscape is through centralized inspection and policing nodes. And dear God, what a dystopian future that looks like to me (˃̣̣̥ᯅ˂̣̣̥)
what a dream. sam is selling the cure (tokens) and disease (new model releases). he just cranks up that disease when he needs to sell more of the cure. ceo of the decade.
When is the blackwall going live?
With php2shell going mainstream, to the point that random friends who happen to know I'm a programmer, consult me to understand the extent of it, I think they succeeded with their doomerism message.
When we find a bug, we patch it. When we find more bugs, we patch them as well. That's what happened here. Sam is telling us, "we found bugs, it's over" and the general public swallowed the frog.
I mean, there is the bbc interview where they invited a cyber security expert who said he didn't know php existed before the the news broke out. The general public doesn't see that gaff.
We spent decades creating those bugs. Give it few years at least to find them and patch them.
I think I can guess what his proposed solution will be.
you mean regulations which don't really matter for OpenAIs profit, but will hurt/prevent competition, especially new competition from outside of the US?
or selling AI to "make your software secure"?
Both!
Obligatory “We are all trying to find the one who did this!”
Sam Altman is definitely not Oppenheimer.
He is correct that everyone needs the models not just the offense that hacks their way into Mythos while the rest of us are left locked out and hoping for the best. But that statement is ALSO self-serving.
Kinda wish he’d gone into investment banking.
Maybe instead of patching all the bugs we'll instead leverage LLMs rewrite all the software from scratch with fewer exploitable vulnerabilities. That would have been a stupid idea a year ago but now it seems increasingly possible.
Remember: “no mistakes “.
Converting works really well when you have an oracle (something that you can test against and that is comprehensive)
I cannot begin to tell you how many places I have seen where this is fundamentally not the case. Not only are those tests missing, the software is fundamentally not written to be easily tested and in cases where multiple services across companies are concerned; how would you?
Rewriting via LLM is just not something the caretakers of a legacy banking- og state infrastructure system would countenance (not should they).
Well if you want to rewrite something like the PHP engine then you can obviously prompt the LLM to test against the existing legacy engine. You don't necessarily want to rewrite it 100% compatible because the goal is to avoid recreating the same security bugs, but it gives you a pretty good starting point.
LLMs still make mistakes, but generally fewer security mistakes than human developers.
So that there will be no obvious deficiencies...
There likely will be no way to defend the increased rate of cybersecurity issues due to AI, without incorporating AI in the response.
The new patching and security fixes might be perpetual hotfixes.
This could mean tough times for the cloud in some ways.
Whatever one may think of AI, it's certainly showing the sh*ty shape normal cyber security is in.
I mean, the various supply-chain exploits we've seen said "we allow a dubious third party to blindly update our server 'cause it saves us admin money" and that speaks to how much other shoddiness a significant portion of companies allow on their servers.
It would be better if grant distribution relied on something saner than the effort to write a grant application, if education didn't rely the effort to write poor quality essays and servers didn't rely on the effort required to find the bugs you know are there. But those ships have sailed and I guess we're all just at sea.
Yeah, the staggering amount of CVEs in qmail and postfix can never be remedied. What a clown. Has he ever programmed seriously?
Notably, those didn't need a ton of patching over time. I mean relatively speaking. We've known how to build and deploy defensible software for a long time. We might just have to stop using the projects that need constant patching to keep up, and migrate to ones that are designed better.
Regulate the bugs
The strongest potions, you cant handle them.
If they actually think that this version of AI is that dangerous, then the real risk is that USA and China will work together on a joint "AI non-proliferation" agreement much the same way that nuclear weapons technology became restricted by those that already had it. This will lead to a de facto techno-colonization of the rest of the world just between themselves.
We already saw Trump and Xi discussing this exact scenario last month during their summit.
This was always going to be the risk for countries not investing heavily in their own frontier AI. The US and China are going to control it all and then decide that it's too dangerous to share.