Security Scanning Scaled by LLMs: Exploit Finding Gets Automated
Thread 49480466, 'Just the rumour of a bug is enough to find an exploit these days,' hit a nerve. The rclone maintainer noted that in the first 10 years of the project they received around 20 security disclosures. In a recent period, they dealt with over 40. The comment thread attributed this directly to LLMs lowering the bar for automated exploit scanning: 'It's scaled and democratized to mass exploitation.'
This is a structural shift, not a temporary spike. The same tools that help developers write code faster help attackers find bugs faster. And the comment that cut deepest came from someone who noted: 'My bosses just want speed and will give me a 30 minute lecture on why I don't need to solve a bug that Claude solved.' The pressure against fixing security issues is cultural and organizational, not technical.
The IoT security thread (37392676), an older Ask HN where an FCC commissioner was asking for input on mandatory security update requirements, resurfaces here as context. The regulatory environment around security is moving slowly while the attack surface is moving quickly.
So what?
If you maintain any open source code or run any public-facing infrastructure, your exposure to automated scanning has increased substantially in the past year. Budget time for security review that you would not have budgeted before, and treat disclosure reports as signals of broader automated scanning, not individual researcher curiosity. The rclone maintainer's experience is probably going to be yours if it isn't already.