Trail of Bits and OpenAI's Patch the Planet initiative used GPT-5.5-Cyber to autonomously build a bespoke fuzzing harness for zlib in a single day, discovering multiple vulnerabilities now undergoing coordinated disclosure. The model independently chose dynamic fuzzing over static review, wrote C/C++ harnesses across a dozen entrypoints, used ASan/UBSan builds and compile-time variants, and demonstrated disciplined reporting by filtering out unreachable crashes. This represents a significant shift in the threat model: the expertise barrier for bespoke fuzzing has collapsed, making large-scale vulnerability discovery accessible to both skilled researchers and low-skill attackers.
Open Source Security
3 posts
Field reports from Patch the Planet Feross on the 10 Minutes or Less Podcast: Nobody Reads the Code The article highlights a podcast discussion featuring Socket CEO Feross Aboukhadijeh on the escalating threats to the open-source supply chain, including the Axios backdoor attack and nation-state targeting of maintainers. It emphasizes the systemic risks of relying on unreviewed open-source code and the dual role of AI in both exacerbating and defending against these emerging threats.
Node.js Drops Bug Bounty Rewards After Funding Dries Up The Node.js project has paused its bug bounty program following the suspension of the Internet Bug Bounty (IBB) initiative, which provided its funding. The shift highlights ongoing challenges in open-source security funding and the strain caused by high volumes of low-quality, AI-generated vulnerability reports.
