TLDR Tech / InfoSec
We've Been Here Before: Decompilers, Fuzzers, and Now AI (8 minute read)
ClearSecLabs has pushed back on Thomas Ptacek's "Vulnerability Research Is Cooked" thesis, arguing that the AI panic echoes prior cycles around the Hex-Rays decompiler, AFL/libFuzzer, and CodeQL/Semgrep, each of which automated the easy version of the work and made human judgment more valuable, not less. The author concedes LLMs are qualitatively different, citing Anthropic's 500+ validated vulnerabilities, AI finding 12 of 12 OpenSSL zero-days before humans, and Claude Mythos's discovery of CVE-2026-4747 (a 17-year-old RCE in FreeBSD), alongside RSA 2026 warnings from Kevin Mandia and Alex Stamos of exponential exploit discovery but counters that defenders get the same tools, novel bug-class discovery still requires human creativity, and AI in CI/CD pipelines structurally favors defense (where fixing the weakest link beats an attacker's one-shot chain). Practitioners should treat this as the equilibrium argument it is: invest in directing agents now rather than competing against them, pair LLM pattern-matching with domain intuition for logic and state-machine flaws, and expect a continued flood of low-quality AI-generated reports (as the curl project has documented) that defenders will need triage workflows to filter.
Read the full story