I wonder if at this exact moment one could succeed in filing a issue against an open source project for an entirely ficticious vulnerability, get it assigned a CVE and a github score, and then get the upstream project to accept your patch for the vulnerability, with all these things presented as the issue, the CVE, and the PR being written by generative AI, but in fact you wrote them substantially by hand and the patch for your nonexistent vuln is actually a backdoor
0 Boosts
0 Likes
@mcc at least one paper published last year in a computer science conference could assess that LLM evaluation can easily be gamed if you use LLM yourself.
@mcc "well, i can't find this vuln, but AI is so much better at finding them these days..."
@mcc I imagine if such a submission were to exist, it'd focus on very esoteric code, like out of memory handling and longjmp, to introduce the trojan vulnerability.
Very probably the more your submission appeared to be written by generative AI, the more likely it would be to be accepted. If some person came in with an ungainly, unreadable patch and was aggressively pushing a project to accept it you'd get suspicious and wonder why but if an AI did that you'd be oh well AIs are just like that and AI written code is just like that