Interesting question with (too few but) nice comments: [Wayback/Archive] Tom Schuster: “To my security peeps: Was the …” – Hachyderm.io
- To my security peeps: Was the introduction of widespread fuzzing similar to AI-based bug hunting now, or is this really a different beast?
- @evilpie IMHO it’s very similar, definitely larger scale though
- @buherator @evilpie agree that it is similar, it feels like the larger scale is mainly because the security industry grew and many people experiment with LLMs. Prompting seems more intuitive than writing a harness for AFL, so it’s probably more how humans approach than the tool. It’s just another tool.
- Signal to noise ratio is worse with LLMs but but but but but
- @floyd @evilpie I tried to avoid elaborating on “scale” because it refers to many things in this case, e.g.:- How easily you can adapt to a new target (vs. AFL)
– How much power is available for the task (GPU acceleration)
– Number of bug classes you can (trivially) aim for (vs. fuzzing for logic bugs)
– etc.
--jeroen
