Fallthrough Another Spectre In The Shell
Apr 11, 2026
They unpack an AI model that uncovered dozens of deep zero-days and a 27-year-old OpenBSD bug. They wrestle with what widespread exploit generation means for supply chain security and memory-safe languages. They debate cooldowns for package upgrades, recall large-scale vulnerability remediation stories, and explore AI as a personal assistant and scalable source-control ideas.
AI Snips
Chapters
Transcript
Episode notes
LLMs Can Unearth And Exploit Decades Old Zero Days
- Claude Mythos can autonomously find and exploit deep, long-standing zero-days across major OSes and browsers.
- Anthropic found 147 JS-engine bugs in Firefox and a 27-year OpenBSD bug, showing LLMs surface subtle, multi-stage exploits humans rarely craft.
Automated Research Changes The Threat Model
- Democratized automated vulnerability discovery changes threat models because bugs once impractical to exploit become trivially discoverable and weaponizable.
- Many findings are memory-safety issues remaining from C/C++ code; the quantity accelerates triage demand on small teams.
Use Short Release Delays For Automated Security Checks
- Prefer short analysis delays over blanket cooldowns by exposing new releases only after automated checks run.
- Steve suggests servers could withhold advertising a version as "latest" for days to allow scanners to catch issues.