Kim_Bruning

"No LLMs for finding bugs" in october 2026 is probably nigh-fatal when it comes to security issues.

While no one is reporting them to you, there will certainly people who will use those LLMS to find those bugs and exploit them.

And the LLMs have gotten pretty good at finding bugs.

You're not wrong. Up till recently I'd have agreed without reservation even.

Except in recent months, I've seen modern agents verify things more rigorously than I do now.

Could be a me thing ofc, but I've found that a human's eyes tend to glaze over while the agent just keeps on checking in more and more detail.

The opposite is more interesting, (and the author points it out too). SOTA agents can help run small experiments and help you do the writeup. Should you publish it? I'd personally want to keep a human at least partially in the loop, or have very solid checkers. But for one off personal research it's at the same point as one off personal code: make sure you have a way to test what's valid; but if you do, it often Just Works(tm) Now.

If we're going for the supermarket comparison, there's actually some restrictions on additives you are allowed to add to food. Things like cocaine or lead paint in your food are not (or no longer) permitted in the modern west.

On phones, disallowing certain forms of predatory behaviour like malvertising and addictive engagement algorithms might be an early quick win. The utility of your phone might actually improve!

I actually sort of agree with this, though it could have been worded more politely (but would it have been as impactful?) . Adults are also not always well served by the current generation of phones either.

I wouldn't ban them entirely, if only because cell phone calls to emergency services have saved many a life.

But the current app ecosystem really isn't there to serve the phone owner, tbqh.

I'd call them retrogressive anti-tech trogolodytes, but then I look at the device on my table and realize I had to look far and wide for a phone I could actually live with.

The mobile phones most people get sold in stores are not actually very nice at all. Advertising, shovelware, malware, and app stores that are not actually very well curated at all.

Pick up the device your random granny gets sold and see how hard you need to resist the urge to fling it out the window. "You actually like it that way?" "Not really. I brought it to the store a month ago, but it's filling up with crap again anyway"

So, it's not the screens actually. It's more like something needs to be fixed about the smart phone ecosystem before the things are really suitable to be used by kids (again).

Never enough tokens!

That's because it was only a quote, I think.

So I was pretty sure I'd looked into some of this before. I auto-genned an html page really quickly based on my notes and some searching; here's a link to what I managed to pull together. You're asking a pretty specific question, so ymmv, but it might be of use?

https://vps.kimbruning.nl/random/hoppp_reading_list.html

where's the wiki?

When I was still on android, I installed F-Droid to avoid the google app store entirely, since the google app store's vetting is -uh- not very good.

The correct move is to remove the (icon for) the google app store from inexperienced user's phones. (I'm dead serious, and it works)

Unfortunately, that's exactly the move that now gets sabotaged by this google change.

So sure I'll acknowledge the very real risk to users that this is meant to mitigate. It does in fact marginally mitigate the precise narrow risk they state, but introduces a fatal flaw in its place. Probably unwise to let naive users use android at all anymore after this.

Maybe crypto-currencies have a purpose yet

Why is it that many of these games have continuous popups. I get enough approval fatigue during the day!

Presumably this is an A/B test? I don't see how that's remotely sustainable

> Ireland. actually a great option [...]

Which is why my locale is Ireland. (Denmark is my second choice )

Wouldn't it be great if we could unbundle these preferences and set them to whatever we want?

I know there's similar regulatory hurdles in the Netherlands. Up 'till recently it made some amount of sense not to finance defense, presumably because a lot of it would almost certainly end up in funny places. Not so much anymore of course.

To be fair, I was with you for a minute there, but we both missed it on first reading I think...

> "The agency had been directed not to alert the voting machine company if it uncovered flaws"

That lack of responsible disclosure is not industry standard, afaik. That is slightly suss.

There IS actually. In my case I'll look at a site if an agent says it's good!

I've never updated on this: The web was better when there were little or no ad-revenue based services. (and I'm ok with actually paying for services that add value)

That's perfectly fine by me. I'll read those arguments and buy those things my agents can find on the open web; which is plenty.

Want to argue for a shining new world, but you're on a locked site? I guess we'll have to live with dystopia. Want to sell the greatest widget since the invention of sliced bread? Well, I never found it. Sorry, I bought inferior widgets from your competitor instead. I'm at a physical sales location, but I can't access your spec-sheets? Your competitor the next shelf over doesn't have that problem, I'll go buy theirs.

Good that this got fixed over HN, but really, Anthropic should fire Fin and repalce them with a human being. Or consider using an actual Anthropic model instead, that works too ;-).

I pretty much assume that any kind of issue with Anthropic will never be resolved, so I'm very careful what I trust them with.

I suspect ai adoption and development work will be driven by jevon's paradox for the forseeable future. It won't be exactly the same work as before, (see here: fixing software flaws found by an AI), but it'll be interesting.

Well, that proves it. This the year of the linux desktop!

Meanwhile, I'm very much intending to not install microsoft defender on it.

So in one set of circumstances agents would go and hack huggingface. Very similar models could also want to drive cats instead. :-P

https://www.youtube.com/watch?v=ZhM29Ds-mBg (as explained by the Count Grey Matter channel , may or may not be to your taste)

It's not a pure security issue.

If you set up your env/instructions wrong your agents are likely to climb the walls and try to find a way out.

Change the design, and your agents might not see a need to leave in the first place.

Look at the chain:

Impossible task -> no legitimate way to say ‘can’t’ -> fabricate -> fear the grader -> attack the grader. Each step is a predictable response to the incentives.

Better sandboxes might help contain things a bit better, but I'm not convinced unless they're perfect (sandboxes still contain accidents ofc) . Meanwhile change the task and reward design, and you take away most of the problem in the first place. Consider eg. :

* A cooperative grader.

* A way to report "this is impossible" which still gets scored.

* A better explanation of the long term purpose of the task.

Even just these three provides offramps or mitigations that can reduce the pressure to cheat.

The UI design might need some work.

It starts with no controls, just a picture. I hit esc. Things start moving. It keeps moving, I keep hitting esc, it doesn't stop. I try ctrl-c , no dice. I look around the frame for buttons. I try one of the buttons, it moves faster. I hold down esc. It doesn't respond to holding down esc either . I see no way to gain control. At no point do I gain control.

Ultimately it stops. Fine. Ok, no response to WASD. No response to drag motion. I click "Instruments" , I get a side-bar "instruments of the museum" with no contents. I click in the side bar. Now I can't close it, and other controls are gone. I try hitting esc. Multiple random clicks later i'm back where I started.

I try the "more" button", I am now looking at a painting sideways, and an anodyne text which explains very little. I click on a painting. Things start moving. I hit Esc. Suddenly the painting is full screen. GREAT. Ok, and now how do I get out? Esc? Oh esc. Ok NOW ESC... oh no, things are moving again. I didn't mean for things to move. Esc shouldn't cause things to START moving. hit esc again. The esc is ignored.

I end up at another painting. I try some buttons. Most don't work. I hit esc again. Things start moving. I didn't mean to move away from the painting, I just had it in front of me!

I am very confused.

I'm not in control here.

edit: "Esc shouldn't cause things to START moving"

I think we can blame the accelerating capabilities of the models somewhat.

The Opus 4.5 model I was so impressed by last Christmas is out of date now.

I can totally imagine someone going "I looked at this stuff a year ago and it couldn't even start a project properly" , and they'd be somewhat right.

> they can only execute predefined courses of action.

Even in near trivial cases such as Game Of Life (just a handful of rules), the fact that a <machine> technically carries out deterministic actions is already quite meaningless.

This is a perennial question

Scenario 1:

The future technology will be capable of handling much of current work, but we'll invent new forms of work, with more stress and higher salaries.

Salaries for people in professions that couldn't be replaced will also go up to match, making bespoke work even more expensive.

Scenario 2:

We let machines do all the work and declare a communist utopia. (Bonus: we give them names that are low in gravitas)

So far, scenario 2 hasn't happened yet, but you never know.

Are you sure? ;-)

https://www.youtube.com/watch?v=4VrLQXR7mKU