if anything we should be using ai to find this stuff before the bad actors, too bad the model providers are hell bent on regulatory capture via fear
I'm not saying mythos didn't find anything new, but several people who should have known better were not using SAST/DAST tools to find potential vulnerabilities before pushing their code into the great unknown. One person I talked to said they didn't bother because GitHub automatically runs SAST tools against pull requests. I looked. Their CICD pipeline had no such tool configured. I'm pretty sure it's more appropriate to say GitHub CAN run SAST/DAST tools, if you configure it, but it won't run SAST/DAST tools by default.
This was a very small sample, but I wonder how common this type of confusion is.