Hacker News front pageJun 24, 2026, 07:42 UTC+8

Vulnerability Reports Are Not Special Anymore

Vulnerability reports are not special anymore

Filippo Valsorda argues LLMs have made vulnerability discovery cheap for both defenders and attackers. The scarce insight and confidentiality that once made security reports special are gone. The real bottleneck now is triaging which findings are real, not finding new issues.

Why it matters: Filippo Valsorda, former Go security lead, argues LLMs have made vulnerability reports un-special—a take with real operational weight. Downside: single-author opinion piece with no data, and the topic leans security-process, not a must-read for the broader AI audience.

Read the original ↗Export Markdown

Take

This is worth reading because Filippo ran the Go Security team—he's describing a real workflow shift, not guessing. His core point: external vuln reports used to be special because the researcher's insight was scarce and confidentiality bought time to fix. Now LLMs make discovery cheap for both defenders and attackers. The bottleneck isn't finding issues, it's triaging which ones are real. An external report and an LLM scan have roughly the same signal-to-noise ratio, and confidentiality matters less when attackers can ask their own LLM for the same bugs. His conclusion is blunt: stop treating vuln reports as sacred obligations. Put the energy into rapid remediation and running LLM analysis in CI. I'd read this as a senior maintainer's field note rather than an industry prediction, but the shift it describes is concrete and useful for anyone maintaining open source.

Source: Hacker News front page · words.filippo.io
Published: Jun 24, 2026, 07:42 UTC+8 · Jun 24, 2026