In this case (the PHP bug), the "AI cycle" may have exposed the security vulnerability but it did not create it. If someone released a non-AI-based static analysis tool that was really good at exposing vulnerabilities I wouldn't expect that person to foot the bill of fixing the exposed vulnerabilities
replyThat’s a fine point but the sheer volume of bug discovery and exploitation that is now possible is the problem, not the mere existence of a bug. An undiscovered bug is a problem, billions of coding agents searching every bit of software 24/7 for any vulnerability is a disruptive change that is exacerbated by the speed run competition that disregards the risk.
replyI would steer in this direction: We have a massive mountain of technical debt that is now being laid bare by AI. I suspect that a good portion of the mess for which various three-letter agencies are responsible has its origins in precisely this mess. We should therefore allow things to get worse before they can get better.
replyRailway was just hacked and every environment variable was leaked. People’s accounts are being charged real money. I have to rotate all my keys instead of eating dinner with my kids. My point is we could do this in a safer way rather than a fast way.
replyMaybe programmers should not create so much buggy software. Did you try that?
replyMaybe you shouldn’t have worn that dress…
replyWhat if that same person released non-"AI"" based exploit generation tool? Not so clear cut that they would be off the hook.
But if you just add "AI" suddenly you can both charge money for it and wash your hands of consequences.
reply