ymir_e

I was previously working on LLMs to extract key info from data rooms for energy assets, and this looks great for that use case.

"Does this contract contain ____?" is a pretty typical query for many industries, and then you can have follow up questions that nest down into further info about X, Y or Z thing.

Looks really good for that use case, especially with certainty as part of the output, as you could flag things that didn't have high enough of a certainty to human review.

I'm sure legora and the other legal AI tech softwares are all over this.

I do like the idea of getting everything into one place, but I'm a bit concerned about how it gets the data from each platform.

The platforms have a pretty huge incentive to keep you on their platform, so any top of automation/botting is actively something they try to shut down, or am I incorrect about this?

For example LinkedIn needs to serve ads, if you're able to bypass their UI entirely, you're not getting ads. Or am I missing something here?

Would be cool to hear your thinking around this as well as what technical approach was taken.

Yes! The project I'm working most on has a dev environment that runs a compose witin two scripts: a setup.sh and a run.sh script.

setup.sh figures out which ports are available and changes .env files accordingly. Run.sh runs the actual setup.

I think his point was more that he didn't believe it was difficult to find these issues.

Could be Dunning-Kruger, but if AI models continue to get better this trend will surely continue.

Absolutely. I'm not sure how universal this is, but I saw George Hotz tweeted something about Mythos not being such a big deal since he's able to find security issues without a claimed $20,000 in token spend per vulnerability.

The reality is that humans aren't perfect, so we do not make "perfect programs".

It is also possible to test it yourself to see how good LLMs are at finding software issues:

Find any open source project that isn't huge, then have Kimi 3 review it for potential issues.

You will find code "issues".

Most of the time it won't be detrimental for security, but often there are code paths that are not "accounted for", or you're able to bypass a type of check by interacting with the software in a strange way.

Edits for clarity: seems like this was a controversial take, which I find pretty interesting.

I believe people took this comment as LLMs being better than security aware engineers who have the time to spend building solid systems.

This wasn't the point, the reality outside "established" tech companies is that software security can be lackluster.

There often simply isn't enough resources to check old software for basic vulnerabilities, outdated packages with known issues, there might be a manager who insists on a certain solution. Or that certain services are on "maintenance mode", but rarely get checked since they're on a certain part of the internal network.

If they are able to properly scan their full software stack for CVE issues, they cannot deal with a flood of CVEs.

----

We're in a transition period where AI will eventually make software much more secure than it ever was.

These noisy CVEs will probably lead to agents verifying vulnerabilities before humans review them.

The problem with agent reviews from what I can think of is:

- cost to use LLMs to review things

- not necessarily easy to plug-and-play in repos: (domain knowledge + vulnerability knowledge)

- especially with anthropic: able to use models defensively, without hitting guardrails

The last one is the most interesting one to me. How does the AI providers know if you're a "good or bad" guy? And does it matter if open source models is catching up?

We're in a kind of cyber arms race wether we like it or not.

This was my first thought, this could be terrible if used offensively.

The best defense I can imagine is to have an agent reproduce the issues before a human sees it, but even that will cost money.

You mean wezterm right?

Lately I've seen a lot of people complaining about GitHub downtime, performance and overall quality.

Happy to see something in the right direction. I think they've woken up a bit. Still surprising how slow things can move at big companies.

Companies like Linear, Vercel, Zed and Cursor all seem to be looking at GitHub more aggressively though. I do suspect there will be more competition shortly.

You're spot on here.

If you're truly multi-tasking with this type of setup it feels more like "tiktok coding", "brainrot coding", or any other term that should be used for it.

I'm pretty sure we're moving away from it, the agent you interact with via voice or typing will go to a higher and higher abstraction level, and you won't have to effectively micro-manage them.