alt Hacker NewsCan you explain the asymmetry you are claiming that exists where some models would be excellent at finding faults in code/systems and exploiting them often through coding the required tools to exploit them... but at the same time they would be bad at avoiding this kind of faults when coding the system itself?
Feels like you should be able to prompt the kind of exploits you want to prevent and the model should be able to make the system secured against them, no?
When you know you're looking for an exploit, it's easily verifiable and you can iterate fairly rapidly and get fast feedback, you can just have a test that you don't get a 403 back or something. LLMs, in general, seem good at problems like this.
When you're developing, there's a ton of degrees of freedom, and security encompasses only some of them. To be sure, if you set up a quickly verifiable test for every security flaw, you could probably get LLMs to satisfy them somehow, but there's a lot of those, and it's not necessarily practical.