Really good blog by Joshua Rogers from Aisle about how to do vulnerability hunting using AI. The gist:
- if you set a goal, the AI will try *anything* it learned to reach it, including cheating. It has no morals, it just applies options.
- you need a non-AI gatekeeper to verify findings in various ways to confirm a vulnerability.
„…in some cases, the agents really will happily edit the source code of programs […] adding the vulnerability itself.“
https://joshua.hu/lessons-using-sanitizers-oracle-llm-vulnerability-triage
Stefan Eissing
npub179…nr96e
2026-10-08 05:48:46 UTC
Author Public Key
npub179eu5lkc7wklv8f44w6fz4qpc8gpkk2x8e32k7ha43pgvyj4jkqqqnr96eSeen on
wss://relay.ditto.pubPublished at
2026-10-08 05:48:46 UTCEvent JSON
{
"id": "9b7498ee29275ec9b8ed7a195ed9c6d59d88916a7db17fc81cac406bdbf4584f",
"pubkey": "f173ca7ed8f3adf61d35abb4915401c1d01b59463e62ab7afdac428612559580",
"created_at": 1791438526,
"kind": 1,
"tags": [
[
"proxy",
"https://chaos.social/users/icing/statuses/117403715240459654",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "Really good blog by Joshua Rogers from Aisle about how to do vulnerability hunting using AI. The gist:\n\n- if you set a goal, the AI will try *anything* it learned to reach it, including cheating. It has no morals, it just applies options.\n- you need a non-AI gatekeeper to verify findings in various ways to confirm a vulnerability.\n\n„…in some cases, the agents really will happily edit the source code of programs […] adding the vulnerability itself.“\n\nhttps://joshua.hu/lessons-using-sanitizers-oracle-llm-vulnerability-triage",
"sig": "0b0e3af679d314b818417992a4573e5921e73c007547382d8a0af53f2f07192b43471cbda25da43205aadb56402f5c99af95c9857aee696b3aff0e12a460961f"
}