alt Hacker NewsIn this case (the PHP bug), the "AI cycle" may have exposed the security vulnerability but it did not create it. If someone released a non-AI-based static analysis tool that was really good at exposing vulnerabilities I wouldn't expect that person to foot the bill of fixing the exposed vulnerabilities
Replies
dmz73 • today at 9:36 PM
What if that same person released non-"AI"" based exploit generation tool? Not so clear cut that they would be off the hook. But if you just add "AI" suddenly you can both charge money for it and wash your hands of consequences.
That’s a fine point but the sheer volume of bug discovery and exploitation that is now possible is the problem, not the mere existence of a bug. An undiscovered bug is a problem, billions of coding agents searching every bit of software 24/7 for any vulnerability is a disruptive change that is exacerbated by the speed run competition that disregards the risk.