the magic's not too magic
2026-09-09 18:10:29.257604+02 by Dan Lyke 0 comments
abadidea @0xabad1dea@infosec.exchange
Project Glasswing:
Claiming to have found 26 thousand real vulnerabilities but only 0.8% of them have resulted in a real fix in a real project after five months is dire. They blame it on the human independent review bottleneck, but human experts being paid for their time definitely have a higher throughput than that when working with data that’s actually actionable.
Goes on to talk about a lot of the ways that these reports of exploit finders appear to be horrendously overblown on lots of fronts. And links to The Anthropic Glasswing Receipts Are Starting to Trickle In.
Glyph @glyph@mastodon.social notes:
I don't think Twisted is in Glasswing's purview but this lines *right* up with the reports we have gotten. Overwhelming, but fewer than advertised, considerably less serious than the bots rate them, and, shall we say, poor quality remediations that would be unusable even if our policy were to accept slop fixes
[object Object] @zzt@mas.to also links to the original toot, noting:
taking into account the absolutely massive amounts of money, resources, and staff used on this, the results are horrible. you can get effectively the same results from an automated vulnerability scanner. some of those can even write up an awful little exploit for you too! it turns out the magic was pouring millions of dollars into doing this crap and having a bunch of uncredited human labor (from an AI corp? unthinkable) sort through everything. and even then the magic’s not too magic.
Edit: Glyph @glyph@mastodon.social adds:
This stuff is really starting to make me _angry_. Every one of these new "achievements" looks plausible and like Lucy with the football, people I trust keep telling me it actually works and surely this time it's real. And then like clockwork, 3-6 months later, it turns out that the efficacy of this new technique is somewhere between "break even" and "fraud".
They're turning our whole industry, my entire life's work, into a goddamn memecoin pump and dump scam and I just don't know what to do.
Fucking yes. That last sentence.