Can't agree more. Same situation here. Last week LLM ran for many hours, claiming ~99.9% success rate for an exploit but ultimately gave it up. I had to manually root-cause and fix it quickly. The highlight is that it did find a vulnerability I likely would have missed, mainly because I'm not familiar with the internals. However, it also overlooked some deeper vulnerabilities until I prompted "what if...". IMO, LLMs can indeed help with bug hunting, but don't fully rely on them, especially for exploits, at least, for now.

And to summarize - I wasted roughly 15 hours of my life and tons of tokens to eventually give up, reverse engineer manually and find the cause of what I was looking for in like 1 hour. LLMs are great but are no replacement for real, hardcore research.

New blog post from TAG with details of a North Korean campaign targeting security researchers working on vulnerability research and development. blog.google/threat-analysis-… Stay safe out there everyone!