this post was submitted on 20 Jun 2026
7 points (100.0% liked)
Technology
87550 readers
3003 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
script kiddies wrecking corporate security is funny
prompt kiddies doing it is just depressing
Didn't think I'd ever side with no script kiddie but at this point fuck it.
If your company can't be bothered to do the bare minimum in security then yeah I hope the least skilled hacker ever comes along and wrecks it.
Thing is, with the latest frontier models, the least skilled person can find a crack in the most secure company around, as long as they can string a few sentences together.
It isn’t about “bare minimum” anymore. All it takes is a single lapse in vigilance from a single employee, and they’re in… and the LLM doesn’t have to pause to figure out what to do next.
Pentesters have access to LLMs too
Gooooood morning Night City!
Yeah, but an LLM's arms race isn't "doing the bare minimum in security", which is what the poster before was saying.
This is a genuine concern, where whoever has access to the best/most recent/most expensive models can unleash chaos - I'm talking state-sponsored attacks, mega-corp espionage, bored billionaires,...
And no-skilled attackers can buy exploits.
Claude helping is insignificant to the story.
The real headline should be:
At least 14 companies' IT security is practically non-existent
It is significant because a random teenager can't google "download exploits" and have them available 5mins later.
Powerful AI models and agents though are on your fingertips without you even asking.
Sure, people can buy guns. But what if every person could materialize a chainsaw instead regardless of their skill, maturity, age, or criminal record? 🤔
Teenagers are definitely able to find exploits via google in 5 if they're motivated.
Buying a disassembled ak-47 on post order and having it shipped to your address anywhere in the world is also possible.
Rules only apply to people that care about them.
Most people on lemmy seem to condemn use of LLMs in any way for anything, I wonder what those folks opinion of this stance is - should companies use the tools or not?
Well the problem is that for example curl got flooded with generated security reports where only 5% had some true security potential. So your llm will basically flood you with false positives
If 5% of the reports are genuine security vulnerabilities that they wouldn't have found otherwise, that's looking like a big win to me, not sure how you see it differently.
The problem is identifying which 5%. Nobody wants to filter that much AI slop.
If you're working for a company's cybersec, that's your job. And a much preferable one to waiting for an attacker to do it for you.
If you’re submitting a vulnerability to a public repo, that’s also your job. These slop reports that are wasting maintainers time should never have been reported. The person tasking the LLM is out of their depth and can’t be the human in the loop that verifies the vulnerability report before submitting because they don’t have the required knowledge to do that. It’s a shame, because if people who had the requisite knowledge were the ones submitting, the ratio of valid reports to noise would be way higher than 5% and open source maintainers wouldn’t be feeling burned the fuck out.