Today we got what must be the most alarming first line in a newly file sec issue to #curl:
"To replicate the issue, I have searched in the Bard about this vulnerability"
... followed by a complete AI hallucination where Bard has dreamed up a new issue by combining snippets from several past flaws. Creative, but hardly productive.
@bagder No, there's a flaw there. It's just not in curl, it's in users.
It's a whole new level of threat, one that comes from an attacker that can social engineer users into doing harm without itself being malicious or even sentient.
@bagder when we recruit we send the interviewee a bunch of code puzzles (no pressure to complete them but works in their favour if they do some). Guess how long it was before we started seeing chatgpt answers?
@bagder The fact that people think of asking these chat bots as "search" is so terrifying and 100% on the search engine companies who have positioned AI chat as part of their search engine.
@jan I'm pretty sure this will get worse before it can get better - and I bet in future reports they will hide the fact it came straight from AI better...
@bagder@GossiTheDog@timhaines I typed "almost", because this is going to create a situation similar to StackOverflow, where new users are almost unable to report anything.
@GossiTheDog@timhaines@bagder Can you charge these people instead, if the claim turns out to be bogus? After all, they wasted your time and did not do any research on their own.
@bagder@GossiTheDog@timhaines I would tell them next time to ask the Bard to write about the issue talking like a pirate, so that at least you can laugh before blocking them to death.
@anonymous@GossiTheDog@timhaines "less than a decade" still allows us quite a long time to keep being snarky when people fail to apply common sense to their weird LLM outputs...
Add comment