I have free access to many “Frontier” LLMs including advanced/restricted cybersecurity models, and I respect their advanced ability to do vulnerability research and exploit development.
Using them at all drags on me morally knowing every time I ask them something and they grind for awhile it’s mostly gas turbines powering that computation.
But the thing that drags on me most is how LLMs reflect various information ecosystems where the “default” answers are wrong/bullshit/gamed, and worse presented as false “yes/no” dichotomies and not “it’s complicated”.
They are almost “bipolar” (hopefully no offense to the afflicted) where asking followup questions and getting remotely technical on a topic can lead them to completely flip their answer.
So laymen get the wrong answer and only experts on a topic can coax the right answers out.
This, and many other similar quirks of LLMs, are practically dystopian.
At the same time I’m trying to break my own code faster than randos can break it just to cut down on the number of security advisory reports I receive, most of which are bullshit and should be filed as regular issues if not outright closed.
One problem is the more hardening I add like static analysis, the more the LLMs have to play around with to break my code. Which, if it’s a legitimate finding is a plus, but it’s really not fun to have each static analysis improvement lead to an explosion in LLM-filed reports.