Hacker News new | ask | show | jobs
by Manishearth 34 days ago
I recently used a pretty well-tuned LLM to find ~500 safety bugs across the Rust ecosystem. Most of them are minor, and even major safety issues in Rust usually mean "it's possible to accidentally use this API in a way that is broken" not "this is directly exploitable", but I didn't want to just file LLM output as issues on these repos.

I very briefly considered doing something like this: if I just post the results on the internet, people can crowdsource filing issues and working on fixes. It's certainly not the nicest way of doing this, but on balance I'd like these issues to be fixed eventually.

I ended up not doing that and am instead filing a couple issues a day because it's not that much of a burden. This was an experiment that was much more successful than I expected, so I didn't budget to spend this time, but it's also not a huge deal to slowly do it.
2 comments
Aurornis 34 days ago
Can you at least provide some links to examples of the issues you’re filing?

I’ve seen so many claims of people who used LLMs to generate hundreds of issues that turned out to be full of hallucinations or non-bugs being described as bugs that any claim like this needs some real evidence. Saying you found 500 safety bugs in Rust but that you’re casually only filing a couple of them makes this hard to believe.

link
asqueella 32 days ago
Don't let the hype turn you into a cynic. You're replying to a Rust core team member, who explicitly says the issues are mostly minor, across Rust ecosystem and not in Rust itself, and that they're filing them manually to avoid dumping unreviewed AI output on people.

It's easy to find the 37 issues they have already filed: https://github.com/search?q=soundness+gemini++author%3AManis...

link
blazespin 34 days ago
I have a dozen or so critical CVEs now, it's not hard to believe at all if they're just hardening tasks. I can get a dozen hardening tasks from just one prompt. I don't even bother filing them as the critical ones are more important right now.
link
flyingshelf 34 days ago
You're using AI to find issues, why are you not using AI to fix them? Issues are for humans.

Of course don't just spam untested PRs as that will land you in PR jail very quickly.

link