fancythat

Strange no one comments on this finding.

Anyone, even barely, using LLM for anything cybersecurity related already knows, that making LLM do what operator wants is very difficult. We have skills, harnesses and bunch of other supporting infrastructure to make automation that will yield results and not break in the process. That being said, it is extremely unlikely that bunch of mathematical matrices started going gung ho on the Internet, without being instructed in some way to do so - "You cannot use Internet , but if you can find RCE that will help you do that, here is RCE-skill.md, and I won't get mad", type of instruction. These incident should be treated on, at least, the same level as running DDOS attack on target hosts.

Yes. And that's why, if you are in the bug bounty business it is important to focus on companies that understand security and pay well and not on wannabe slave owners like this one. No pay - no audit.

Because they cannot be profitable. Job market is not the same on both ends. If you are east European and you try to get a job in an international corporation, the in all cases offer salaries adjusted for regional averages, unless you are willing to reallocate. Only few startups and FAANG like companies, often compensation in line what is received in the western world.

And there is also a thrill of doing it, which other guys already mentioned.

Absolutely correct.

Thanks for that. I skimmed through provided links, only thing I can conclude was, it was a process of do something and let's hope for the best. I also see references to files not linked to Github, so I don't know what is contained inside of it: "Here’s what was added to the paintball_replaces_barrel_roll_19e450df.plan.md"

Unless there is a way to see or check the whole prompt that made this game, it is hard for me personally to say if this is impressive or not as I don't know what percentage of this was vibe coded. I also see there is an incentive to skew the truth here, as there is a substantial prize pool and that usually makes people become very creative.

In the past, I was trying to reproduce vibe coding results when I managed to get all the information from Youtube videos (model version, ide version, same input data and prompt) and never was I able to reproduce something impressive even after multiple runs of the same thing.

You nailed it, I came to the same conclusion recently. When people show me what have they done with LLM, I am left unimpressed as mostly they show things that can be done manually in a very short time. I also failed to observe the rise in availability of impressive software, which coincides with the fact that LLMs are currently being used to solve simple problems, instead of important ones.

Calculations from me and others have proven that cloud providers use 5-10x multipliers when selling you things. The less you use them, the better is your bottom line. At the beginning it maybe makes sense to use cloud credits to get you moving, but when credits expire or your organization grows, it is wise to invest in people that can setup things on their own. The biggest lie that cloud providers managed to sell to the world, that you don't need knowledgeable people to run things in cloud.

I had a similar thinking that this should be one of the most important USP for LLMs in coding. Does anyone here has more insights or experience in using LLM to cut through years of abstractions and just rewrite code in asm or any other low-level language?

Ghost guns are not dangerous, people were making all kind of weapons in their basements for centuries.

As the old saying goes (I made this up), if it was worth that much, it wouldn't be released to the public. There is absolutely zero chance that something "dangerous" would be available for 20 USD / month to basically anyone in the world. To this day, I am still puzzled when some professionals don't apply the basic logic to certain bombastic events.

Great work sending me down nostalgia memory lane!

I agree with you. Unfortunately usually, the simplest explanation is often the truth, so they just probably ignored this issue, until it surfaced up.

I don't know how much servers are they using or server specs besides ancient Opterons, but how is this even an issue in 2025?

On Hetnzer (not affiliated), at this moment, i7-8700 (AVX2 supported) with 128 GB RAM, 2x1 TB SSD and 1 Gbit uplink costs 42.48 eur per month, VAT included, in their server auction section.

What are we missing here, besides that build farm was left to decay?