Romain Gaucher

Security and code, scaling.

[chrisrohlf @chrisrohlf]

Your contract with a software vendor is one of the highest security leverage points you have. Demand they use the latest frontier models to continually improve the security of that code base, and to demonstrate evidence of that effort every quarter.

[Halvar Flake @halvarflake]

I have a personal update: Next monday, I will be starting at @OpenAI working on better cyber (which will also entail some efficiency work). I'm pretty excited about the things I will learn and the things we will do.

[Semgrep @semgrep]

The Node.js sandbox library vm2 has disclosed a critical vulnerability that allows attackers to escape the sandbox and execute arbitrary code. The exploit is public, the CVSS score is 9.8, and any use of vm2 v3.10.1 or earlier should be considered affected. Immediate upgrade is recommended.Learn more in our blog post from @InsiderPhD and Kurt Boberg.

https://t.co/RZlkg1O4Pp

[Greg Brockman @gdb]

rust is a perfect language for agents, given that if it compiles it's ~correct

[Romain Gaucher @rgaucher]

Anterograde amnesia. Opus 4.1 happily raising a javascript URI XSS vector in the CSS's url() function. Nope. What's next, vbscript: ?

[Romain Gaucher @rgaucher]

But it's the first model, I think, that generates codeFlows in SARIF.

[Romain Gaucher @rgaucher]

I find it fascinating that `gpt5-codex` is making the same mistake often when generating a SARIF file. The last "locations" object is not properly closed and it closes the array before... then it craps out.

[Charlie Eriksen @CharlieEriksen]

Ok, so this MUST be the attackers behind Nx at play. I just started analyzing the exfil mechanism through GitHub repos, and wow... This is bad news. We've got a worm on our hands.

[Romain Gaucher @rgaucher]

@IceSolst Fair point. I'll try to accelerate the time to releasing the Semgrep data. We're also in the process of using GPT-5 (instead of o4-mini)...

[Romain Gaucher @rgaucher]

@IceSolst This is the reason why we're doing this research. Improving our understanding of AI+SAST and what it means.

[Romain Gaucher @rgaucher]

@IceSolst Re: comparing with Semgrep, we're trying to make sure we don't fall into the "LLMs suck Semgrep is the best" though and go past the product into the what does the future of SAST look like with LLMs

[Romain Gaucher @rgaucher]

We just released our deep look at Claude Code and Codex on real web apps for finding vulns. Some good, some pretty bad! https://t.co/9hw4z7xxdE

[Romain Gaucher @rgaucher]

nx compromised. malware uses Claude Code CLI/Gemini CLI to explore the filesystem - https://t.co/l1qAfuo2H2

[Charlie Marsh @charliermarsh]

ty, our upcoming static type checker and language server for Python, is accidentally on the front page of HN.

We're rapidly closing in on an initial "experimental preview release"...

[Nathan Lambert @natolambert]

New export controls incoming, Bloomberg reporting:
"But if an AI company wants to fine-tune a general-purpose open weight model for a specific purpose, and that process uses a significant amount of computing power, they would need to apply for a US government license to do so in a Tier 2 country."

Controlling who in the entire world can finetune on what seems like a losing and generally bad proposition.

[Sean Heelan @seanhn]

Having seen xbow in action: if you’re making a living from bug bounties, and relying on generic vulnerability classes, I would consider alternative career plans