It's correct that at the right hands these tools can augment visibility and tracing of issues. But only if your priority is to look for these issues. The problem is that nobody seems to be looking. AI won't magically tell you once you open a random context, hey you have race condition there, an invalid state there, a threadlock there. It needs investigation. So far the evidence we have from the open source packs is that their developers are not activelly looking. Check my other thread about how to dupe adena in L2JMobius. Confirmed exploit ingame, 2 lines patch, he didn't even bother to fix it. Previous exploit about adena dupe in his pack, same thing, reported exploit, reproduced, patch shared, only applied it after enough pressure and countless of arguments with his team so as they finally get to understand how it works. Now regarding patching and contributing. The nature of patching and contributing has changed. It's more valuable to investigate, prompt the right questions and instructions, find and validate an issue, than sharing the patch. The patch is easy to generate once the exploit is shared. Some people operate under the assumption that we will hand-feed them PR requests for issues they have caused themselves. You are wrong to believe that AI tools will make the code more secure. Here's where we disagree. The tools are only good for what you use them for. Most people use them to prototype things, get them to "just work". There's tons of new code created this way every day, that simply there's not enough manpower to use the AI tools to do security analysis. To put it simpler: If 10 people use AI to make features and only 2 look for security in them, the 2 will get simply overwhelmed. It's only nature. Thats the reason we are entering a bad phase for security, it's not the quality of the AI tools, but hte priorities people seem to have with them. AGAIN: if you are so sure that your pack is secure, tell us its name so as we can audit it. Hiding behind anonymity so as only the open source projects take the bullet is not a proof of security.
By
aguy · 1 hour ago 1 hr