[rvz]

> Pwno is a AI cybersecurity startup...

We all know that LLMs were used to find these vulnerabilities, specifically on high impact projects. That's fine.

However, my only question is who actually provided the patch: The maintainers of FFmpeg? The LLM that is being used? Or the security researchers themselves after finding the issue?

It seems that these two statements about the issue are in conflict:

> We found and patched 6 memory vulnerabilities in FFmpeg in two days.

> Dec, 2025: avcodec/exif maintainer provided patch.

[tredre3]

PWNO provided a patch but it was rejected for being too large[1]. A maintainer fixed it himself[2]. I don't know if PWNO used a LLM but it seems clear that the maintainer had a preferred specific style in mind so it was likely hand written (albeit inspired by the initial patch).

1. https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21258

2. https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/4bfac71ecd96488...

[j1elo]

I just need to say that "commits" has been translated to Spanish as "confirmations" in that website, and it made me chuckle.

Is Forgejo using LLM-assisted translations? Or simply somepne without any context whatsoever in order to understand the word's meaning?

---- EDIT:

I went on a fun detour to inform myself better, and ended up finding [1] where Gitlab had the same discussion. Seems some translations have tried to use "confirmation" as translation for a git commit.

But really, this is one of those cases where no local word is able to appropriately describe such an unique concept oridea. I'd love to retroactively chime in and confirm (hah) that the english word "Commit" has trascended any translation attempts, and absolutely nobody would know what you're talking about if you say "confirmation" in an attempt to use a spanish term.

So Forgejo authors if you read this: it'd better to do as Gitlab did.

[1]: https://gitlab.com/gitlab-org/gitlab/-/issues/215956

[9cb14c1ec0]

> We all know that LLMs were used to find these vulnerabilities

How do we know that? You seem quite certain.

[hedgehog]

They pitch their company as finding bugs "with AI". It's not hard to point one of the coding agents at a repo URL and have it find bugs even in code that's been in the wild for a long time, looking at their list that looks likely to be what they're doing.

[bgwalter]

The list is pretty short though for 8 months. ossfuzz has found a lot more even with the fuzzers often not covering a lot of the code base.

Manually paying people to write fuzzers by hand would yield a lot more and be less expensive than data centers and burning money, but who wants to pay people in 2026?

[tptacek]

Bugs are not equivalently findable and different techniques surface different bugs. The direct comparison you're trying to draw here doesn't hold.

[bgwalter]

It does not matter what purported categories buffer overflows are in when manual fuzzing finds 100 and "AI" finds 5.

If Google gave open source projects $100,000 per year for a competent QA person, it would cost less than this "AI" money straw fire and produce better results. Maybe the QA person would also find the 5 "AI" detected bugs.

[tptacek]

This would make sense if every memory corruption vulnerability was equivalently exploitable, which is of course not true. I think you'll find Google does in fact fuzz ffmpeg, though.

[hedgehog]

I can't speak to what exactly this team is doing but I haven't seen any evidence that with-robot finds less bugs than without-robot. I do have some experience in this area.