> OpenAI researchers noted in their blog post:
> "Within the next few years, we believe that if there are vulnerabilities in a given software project, frontier models will likely be able to discover them and even less capable models may be able to develop exploits once disclosed. "
So, you should pay for OpenAI models because "inferior" models would be able to exploit vulnerabilities... sounds more like an ad that a research paper on the part of OpenAI.
It's only been a few hours, but I'm surprised this hasn't gotten much response. Maybe the west coast hasn't woken up yet.
I question Anthropic and OpenAI's motives every time they do a fear mongering press release, but I think it's smart to draw attention to local exploits. Basically, if you aren't running software you don't trust, there isn't the same immediate panic as remote exploits. It advertises the problem without ruining everyone's day.
On the other hand, most people are running code that shouldn't be trusted. Browsers and games normalized automatic software updates, and lots of other applications followed. It's not just a matter of whether your system has remote vulnerabilities, we should be concerned if that terminal emulator or compiler you like is being updated from a server with vulnerabilities.
> OpenAI researchers noted in their blog post: > "Within the next few years, we believe that if there are vulnerabilities in a given software project, frontier models will likely be able to discover them and even less capable models may be able to develop exploits once disclosed. "
So, you should pay for OpenAI models because "inferior" models would be able to exploit vulnerabilities... sounds more like an ad that a research paper on the part of OpenAI.
Or
"Find and fix these flaws now before they are zero days taking your infrastructure down"
But hey, you do you.
It's only been a few hours, but I'm surprised this hasn't gotten much response. Maybe the west coast hasn't woken up yet.
I question Anthropic and OpenAI's motives every time they do a fear mongering press release, but I think it's smart to draw attention to local exploits. Basically, if you aren't running software you don't trust, there isn't the same immediate panic as remote exploits. It advertises the problem without ruining everyone's day.
On the other hand, most people are running code that shouldn't be trusted. Browsers and games normalized automatic software updates, and lots of other applications followed. It's not just a matter of whether your system has remote vulnerabilities, we should be concerned if that terminal emulator or compiler you like is being updated from a server with vulnerabilities.
*NIX "local user" is obsolote concept anyway since mail providers choose/was forced to use virtual users instead of making passwd file full of names.
Linux/Android are mostly one-user systems.
Oh, wait... There is also such invention like docker and x86 "virtualization" :)