I have found multiple exploitable vulnerabilities simply by asking an LLM
19h on Hacker News
In the thread “Hallucineted CVE against Curl: someone asked Bard to find a vulnerability”
Helped: Rewriting functions to idiomatic equivalents before asking for vulnerabilities.
Got in the way: LLMs struggle with disassembled Rust binaries.
I’m doing reverse engineering work every now and then and a year ago I’d have called myself a fool but I have found multiple exploitable vulnerabilities simply by asking an LLM (Claude refuses less often than GPT4, GPT4 generally got better results when properly phrasing the request). One interesting find is that I wrote an integration with GPT4 for binaryninja and funnily enough when asking the LLM to rewrite a function into “its idiomatic equivalent, refactored and simplified without detail removal” and then asking it to find …