OpenAI演示利用大模型自动发现并修复安全漏洞
Block on Finding and Fixing Security Risks with OpenAI
展示了大模型在安全领域的闭环实战能力，从漏洞挖掘到自动修复全流程自动化，对做 AI 安全或 DevSecOps 的同学极具参考价值，建议关注其具体实现逻辑。
Every attacker potentially has an advanced capability in their pocket. There's been a lot of tools that could hunt through software and say here's a error in your code overall. But this is able to chain together with hypothesizing about attack patterns crossing trust boundaries and chaining together a series of attacks to give you an endto-end compromise. You find you know where it is in software. You find who owns that software.
每位攻击者口袋中都可能藏有高级能力。过去有许多工具能够扫描软件并指出代码中存在的整体错误。但如今，我们能够基于对跨越信任边界的攻击模式的假设，将一系列攻击串联起来，从而实现端到端的系统沦陷。你可以精准定位漏洞在软件中的位置，并明确该软件的归属方。
You propose a patch for that. You confirm exploitability and then you verify that you have fixed it overall with a human in the loop guiding it and deploying the code. It's scary of course like you know that this maybe has existed for years and you didn't know about it but now you know and now you can take action before someone else knows.
随后你提出修复补丁，确认漏洞的可利用性，并在人工引导下验证整体修复效果并部署代码。这当然令人担忧，因为你可能意识到此类问题已存在多年而此前毫无察觉，但现在你已知晓，并能在他人发现之前采取行动。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力