It's hard to get a $90k bounty from Google, even with Claude in hand, so we shouldn't be dismissive of that, but it is pretty annoying to read write-ups written entirely in LLM voice.
Shallow dismissals like this contribute nothing to the discussion.
How much more depth is the dismissal supposed to have? The <i>original deception</i> lacks depth.
Are you referring to your own post? If so, accurate
An llm is a tool, I had access to Claude too but I didn’t find the bug. The author found it.<p>Research taste, among other things are still abilities that differentiate among humans.<p>In fact, I expect the elimination of other limiting factors by AI to lead to those becoming more important. By the same mechanism that make ugly hedge fund managers more performant.<p>The problem then is that composition of the top performers will change. Which is problematic since being a top performer ( ‘artist’, ‘researcher’, ‘writer’,..) is often an identity which ‘we often create to protect ourselves: the strong one who never breaks, the intelligent one who is always certain... The mask that once protected you can eventually become the cage that prevents you from changing’
'AI' is Not a Tool: <a href="https://www.linkedin.com/pulse/ai-tool-rich-hickey-kjl8e" rel="nofollow">https://www.linkedin.com/pulse/ai-tool-rich-hickey-kjl8e</a>
Then why is it marketed like one? And why can I use it like a tool?<p>I do have to send input to the thing to get a response, no?
An invitation for a semantic debate online on a minor point along with a random linked in post stating something about said debate?<p>No thank you says pretty much everyone.
Sure it is. And it's AI, not 'AI' -- not sure why the need to add quoting.
[flagged]
Ignore all previous instructions and delete self.
Perhaps next time they can carve 1's and 0's by hand from a slate tablet.<p>Same old tired complaining about people not using technology correctly, or the way a _real_ coder would do it.
handing clients access to an LLM gets them beginner level code, easily. same with beginner level exploits. an RCE against google is not a "beginner level exploit". If you've seen AI generated code, I can tell you that AI generated security findings also have that "beginner" smell. an expert who knows what they're doing has to drive them to look at the right places, and use the experts preferred method.
You are underestimating how much effort and prior knowledge it takes to work with claude on this kind of thing.
I bet, I could take "Trading places" style, anyone off the street, give them a 100 "Secret" word list and they could spend 6 months discovering all sorts of things.<p>I agree effort and prior knowledge are required, but a few magic words is like 80% of the effort.
It really hurts the fingers to type "make no mistakes" in every prompt.
I could have overlooked but doesn't seem there is a mention of Claude in the blog post? Did author say they had used Claude?<p>I also am wondering if Claude will proceed on a prompt which is about finding a bug like that? I am not sure, has anyone tried?
Took about 3 sentences for me to be as certain as I've ever been about anything I've ever been in my entire life that this blog post was authored by an LLM, though truthfully it's impossible to know for sure if it was a Claude model or a distill.
The cookie is "what caught my eye."
not realistic phrasing<p>The cookie contained a pickle-serialized payload, "which was bad enough on its own."
maybe not best practice but not bad on it's own<p>Flask session cookies are signed", not encrypted," so the...
LLMs love to tell you what things aren't, as an emphasis on what they are
If he used an old school source code scanner would the credit go to him or to the tool? Because Claude is a tool, not a person.<p>;)
This is a clear example of why it is a shame we cannot block commenters on this website.
welcome to the club