Model Releases
A bit over a decade ago, we got fuzzers. A fuzzer is an automated vulnerability-finder that repeatedly runs a target program with semi-rando…
A bit over a decade ago, we got fuzzers. A fuzzer is an automated vulnerability-finder that repeatedly runs a target program with semi-random inputs. One particular fuzzer, American Fuzzy Lop, was not
A bit over a decade ago, we got fuzzers. A fuzzer is an automated vulnerability-finder that repeatedly runs a target program with semi-random inputs. One particular fuzzer, American Fuzzy Lop, was notable for being really good at searching the space of all possible branches in code in order to find the buggy ones. @BenLaurie found some security bugs in my own Cap'n Proto using AFL -- the first vulnerabilities reported in my code. And honestly, I thought that was really cool. Today projects like Chromium and V8 have extensive fuzzing infrastructure that find tons of bugs. Most V8 security bugs are found by their own fuzzing, often before the bug is even released. And, you know, that's pretty great! If you point a fuzzer at a project that hasn't previously been fuzzed, you will probably find a bunch of security bugs. It's not that hard. And of course, bad guys can use fuzzers too. But all the interesting targets have already been fuzzed. So. It's not really that useful to bad guys. On the contrary, fuzzing likely made it a lot harder for bad guys to find vulns. Honestly "AI that can find every vulnerability" sounds way better for the good guys than the bad guys. Not sure why everyone is losing their minds here.
Related
- Appknox launches KnoxIQ to prioritize real-world exploitability in AI-driven application security
- TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories
- Harf-Speech: A Clinically Aligned Framework for Arabic Phoneme-Level Speech Assessment
Source: Jeremy Howard (X) | 2026-04-09