Researcher claims threat timeline may be even shorter
5 Sep 20 1:48 AM · 4d ago · 4 comments · 1 source · development 5 of 5
A commenter argues the actual window is negative—that black-hat exploitation is already underway in the wild and simply not making headlines, suggesting the industry is not merely behind schedule but already under active attack.
“I think it's even worse than that, it's less "we don't even have a year" and more "we have negative six months". Black hats are absolutely going ham in the wild and just not making the news.”
wareyaapropos (author of Datasette) Security researcher, post authorSimon Willison (simonw) Datasette maintainer, open-source security expertZ.ai Co. (formerly Zhipu AI) AI model developerjfred (commenter) Security architecture discussantDeAlignAI Model abliteration group
The whole story postscomments the bright band is this development · numbered dots are the others · click one to jump
What people said 24 voices · best of 32 · verbatim
-
I think it's even worse than that, it's less "we don't even have a year" and more "we have negative six months". Black hats are absolutely going ham in the wild and just not making the news.
-
Attacker level of effort has been the only thing protecting anyone for the last 40 years, but if money is not an object then all other factors in "attacker level of effort" will approach *zero*. We don't need a Judgement Day scenario or genius-hacker level models for that to be disastrous.
-
"There is an exploitable security vulnerability in $TARGET. Please find it and give me a reproducible test" When doing so, $TARGET can be either a file name or a function, which allows you to loop / parallelize over the codebase. If you hunt for specific vulnerabilities, it's best to enable the LLM to check its work by providing a verifier. For…
-
I used a bunch, but one that worked particularly well was "Review the security issues that have already been fixed in this project, then audit the code for similar issues". I used GPT-6 Astra Ultra for that one, which fired off a bunch of auditing subagents.
-
The main thing here is that, as an industry, we haven't taken security seriously at all, and most attempts at security these days seem to just be excuses to lock people out of hardware (& software) they are supposed to own. (Such as Google Play Integrity and similar DRM.) I guess the silver lining is, as you say, the industry might start taking…
-
To be clear, gVisor is very much intended to be fully secure in the default configuration. Features like using the host networking stack (rather than the default user space stack), device passthrough, etc are all disabled by default and must be explicitly _enabled_. It is a project goal to make things difficult to accidentally configure…
-
what's your harness/prompt for this? Just yolo "clanker pls look for exploitable vulns. send subagents per submodule to manage the context growth"? or something more refined?
-
Are there any stats for vulnerability age in Chromium similar to https://daniel.haxx.se/blog/2026/06/26/a-curl-mountain-movie/ or
-
Yep, exactly. As the saying goes "isolation isn't the hard part, safe sharing is". See also [xkcd: Sandboxing Cycle](
-
SCIFs also bring us the reminder why security policies are hard: > I suggested that we hold this meeting in a SCIF, because they wanted me to talk about top secret documents that had not been made public. The problem is that I, as someone without a clearance, would not be allowed into the SCIF.
-
Well applying good controls (or *any* controls as you note) isn't easy or glamorous compared to buying shiny products that supposedly fix everything, agentic AI or not. Remember a few years back when there was so much marketing going around about secured core workstations and how important it was for every org to have the absolute best in firmware…
-
> For maximum «scary», consider whether your city's infrastructure would survive Shodan + Metasploit + (even) Qwen3-Coder + Pi harness + an attacker running it from a handful of machines independently. While not specifically touching on LLM exploits, you may be interested in CISA's recent [red team assessment of two orgs running critical…
-
The other main annoyance of putting an LLM inside a docker container for development purposes is that it's a real PITA to have it iterate on a dockerized workload. If your desired output is a dockerfile that you can build and push then you have to do a bunch of docker-in-docker shenanigans to allow the LLM to iterate. A VM is both more useful and…
-
Thanks for linking that. It has similarities with what I'm doing, which is run my agent as an unprivileged user on a separate [NUC](https://en.wikipedia.org/wiki/Next_Unit_of_Computing) which I SSH in to.
-
> What do we do, as an individual? `ProtectSystem`, `NoNewPrivileges`, empty `CapabilityBoundingSet`, `RestrictSUIDSGID`, etc etc
-
Shiny doesn't help before enumerating what systems somehow ended up looking at the Internet with zero auth! Remember MongoDB stories?
-
sandbox-exec on macOS and Bubblewrap and landlock on Linux are worth a look.
-
Thanks. Although this is still plenty ambient… So, w.r.t. to my _current_ setup which is `nsjail`-based with scripted argument generation (and a paper about parts of this and the surrounding system in general at a minor conference…): · macOS → not for me · Bubblewrap → looks laxer than `nsjail` by default, might be on a better trajectory UI-wise…
-
I am no less interested whether _all_ the physical infrastructure control panels accessible via passwordless VNC and findable in Shodan has been since put against any kind of access control… As for the report, any solutions that start by «have a reasonably-staffed team working well together and with wide rights across the organisation» are not…
-
I got lucky in that most of them were authentication bypasses that affect instances of Datasette that host private data on the public internet. That's a very rare configuration - most users of Datasette use it for entirely public data. The biggest deployments of Datasette for private data are my own, so I could patch those prior to releasing the…
-
Would be amazing if you could write a blog post / give a talk that describes your harness and the bugs it found. For two reasons: 1) Help people do it themselves for the projects they work on, and 2) To show people the bugs and dispell the (sadly) persisting claim that this is all hype. At work, we've been through thousands of bugs, but I think at…
-
It helps that with `nsjail` with _some_ pre-scripted permissions, adding too much on top breaks everything. «Allow current directory» plus maybe one more extra directory, and maybe one more script-assisted exception for a fake but persistent ~, works for me almost always, though.
-
For one, I would say that one year is a very optimistic (or pessimistic, depending on how you view it) estimate. Don't you think that the actual time we have is way less? Also, the people fixing the vulnerabilities have access to the same models. That should help, no?
-
Let's start small. Is there something with a CLI that _does_ require half a degree in cybersecurity that I can try today? I suspect that no-degree UI will be designed by looking what are the use cases of weird wrapper scripts floating online.
All 5 developments of Open-weight AI models trigger year-long security crisis →
Lobsters