Hacker News front pageApr 16, 2026, 18:48 UTC+8

AI cybersecurity is not proof of work

antirez argues AI bug finding is bounded by model intelligence level I, not by brute-force sampling alone; for the same code, execution paths eventually saturate. His concrete example is the OpenBSD SACK bug: weaker models fail even with unlimited tokens because they do not connect window validation, integer overflow, and the NULL branch. The key variable is model quality and access speed, not just more GPU.

Why it matters: High-quality commentary with HKR-H from the contrarian headline, HKR-K from the OpenBSD SACK mechanism and firsthand test, and HKR-R because it hits the 'more sampling vs better models' debate in AI security. Not a product, research release, or multi-source event, so it stays mid

Read the original ↗Export Markdown

Take

AI vulnerability discovery does not settle like proof-of-work; extra GPUs do not turn weak reasoning into exploit understanding. Antirez’s OpenBSD SACK example is the hard hook: the model must connect missing start-window validation, integer overflow, and the supposedly impossible NULL branch. Weak models with unlimited tokens only slap familiar bug-class labels onto code that smells suspicious.

That cuts against a lot of cyber-agent marketing from the last year. Vendors keep selling multi-agent loops, repeated sampling, and tool calls as coverage. Antirez’s point is nastier: paths saturate, then model intelligence I becomes the cap. The wild part is his claim that stronger-but-not-strong-enough models report fewer bugs, because they hallucinate less while still missing the exploit chain. That matches real red-team pain better than another leaderboard bump.

Source: Hacker News front page · antirez.com
Published: Apr 16, 2026, 18:48 UTC+8 · Apr 16, 2026