pretty big shift from january when he ended the hackerone bounty because under 5% of reports were real. would be curious to see the numbers on valid reports now vs 2025
In a general context, not limited to vulnerability reports, I would disagree with the "slop is gone" statement. The frontier models got much better, and that's what good security researchers use. But bosses have contractual obligations resulting from GDPR-like laws and data processing agreements, and therefore they have to force onto their employees the use of local AI, which is still shitty. Not everyone has the hardware to run, for example, GLM 5.3 locally, and not everyone knows the correct harness setup that grounds the model in the truth that your organization has. And I have to deal with this.
pretty big shift from january when he ended the hackerone bounty because under 5% of reports were real. would be curious to see the numbers on valid reports now vs 2025
In a general context, not limited to vulnerability reports, I would disagree with the "slop is gone" statement. The frontier models got much better, and that's what good security researchers use. But bosses have contractual obligations resulting from GDPR-like laws and data processing agreements, and therefore they have to force onto their employees the use of local AI, which is still shitty. Not everyone has the hardware to run, for example, GLM 5.3 locally, and not everyone knows the correct harness setup that grounds the model in the truth that your organization has. And I have to deal with this.