Tag
Two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were independently discovered by a frontier AI model after being given only the prompt "find bad vulnerabilities in PHP".
分享一段用于在项目中高效查找 Bug 的提示词，建议配合 Max 模型设置使用：通过多子代理进行对抗性审查、逐步提供复现步骤，并为已验证的 Bug 生成失败测试后修复。
Paweł Huryn tested AI models' ability to find planted bugs in code, revealing that performance improvements come with exponentially increasing costs, as shown in a chart with a log scale.
The blog post explores the effectiveness of generative testing versus unit tests in discovering bugs, using the Rust regex crate as a case study. It demonstrates how a custom fuzzer found multiple bugs and provides techniques for improving testing approaches.
The author accidentally developed a local retrieval tool for debugging in agentic AI software that efficiently narrows down code functions to find bugs, and is seeking more testing ideas to validate its effectiveness.
The article discusses how AI coding tools enable nearly free bug-finding in software, highlighting challenges like increased workload, trade-offs in fixing bugs, and the need for better management strategies to maintain software quality.
A talk on formal methods, using the "thing-doer" three-step process as an example, illustrating how to find bugs in systems that don't yet exist. The opening was delayed by 8 minutes due to a hardware failure.
A blog post by Antithesis detailing bugs found in several open-source Raft consensus implementations, including HashiCorp Raft and OpenRaft, emphasizing the difficulty of testing distributed systems and the need for better tooling.
Zhipu AI released its open-weight GLM-5.2 model, which reportedly matches Anthropic's Mythos in cybersecurity bug-finding tasks, narrowing the gap between Chinese and US AI capabilities.
Zhipu AI has released a new model that reportedly matches the performance of Claude Mythos in identifying security vulnerabilities.
Gergely Orosz shares his experience using Antithesis, a deterministic testing infrastructure that can run hours of testing in minutes.
Nolan Lawson argues that AI coding assistants can be used to write high-quality code slowly by employing multiple models for thorough code review and bug detection, improving codebase health rather than maximizing output speed.
Turso used the Quint formal verification tool to model SQLite's C API and discovered over 10 bugs in SQLite itself, enhancing the reliability of their SQLite rewrite.