If you ask “what is this large language model vulnerable to?” the answer is: “yes.” You can prompt inject a chatbot almost any way you can think of. Prompt injection is easy because you can’t separ…
  • Soyweiser@awful.systemsEnglish
    5·
    2 days ago

    The unicode stuff amazes me as that is one of the things. That could actually be filtered for. Not doing any input validation. It isnt low hanging fruit, it is already on the floor. The incompetence…

    • BlueMonday1984@awful.systemsEnglish
      10·
      2 days ago

      It feels like the rise of LLMs has set back cybersecurity by a good decade or so, and by my guess it probably has.

      Agents are throwing away decades of hard-learned lessons in input sanitization (providing cybercriminals a Greatest Hits compilation of vulnerabilities), “vibe coding” is introducing vulnerabilities aplenty to codebases and hiding them under mountains of technical debt/unmaintainable code, LLM usage is damaging coding ability in coders both junior and senior, the entire tech field is haemorrhaging talent from burnout and layoffs, and that’s just the things that are immediately coming to mind.

      As I see it, cybersec may find itself practically back to square one once the dust settles.

      • Soyweiser@awful.systemsEnglish
        8·
        2 days ago

        People are using llms to filter logs and alerts which will get someone hacked in a spectacular way eventually. Which will be very funny. And will give people 20 year old flashbacks.

        Also buffer overflows are going to be back as the llm doesnt know to give the length of the correct string to the strncpy. Gonna be funny, if people keep proper backups.