Hi, I am the CEO of Trail of Bits (https://www.trailofbits.com). We've had two of our staff independently write working exploits for this flaw. The first one took about 4 hours, start to finish. The second was a similar amount of time spread over the course of a day. We've tested our exploits to work on an unmodified MediaWiki.
tl;dr writing exploits still requires expertise, even when you're being aided by an LLM
Yes, and it's possible that Podman might accidentally succeed in creating a container that's secure against malicious code running inside of it as a result, but I wouldn't count on it. For that matter, I'm not extremely optimistic about Bubblewrap's chances, either, especially given the experiment described in https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyb....
It also explains that the fact ASan works well with, e.g., std::vector in C++ doesn't come for free and if you want ASan to detect bugs when your custom collections or allocators are used you have to use special ASan API to mark [in]accessible memory.
> The only way it might hold here is if no one with access to the cutting edge models bothers to run your code through one while an adversary does. That seems highly unlikely, particularly for any well funded organization.
But since AI models are non-deterministic and the harness matters a lot, simply "running your code through one" doesn't guarantee you'll find all the zero days. An attacker can simply run a few more iterations or use a slightly more advanced harness, or increase the temperature level and they are likely to find zero days which the maintainers didn't.
Look at TOB-RGM-9 (an informational, largely out-of-scope finding) if you want to understand what could be done to mitigate some of these concerns. Nearly all of these gadget chains rely on Gem library functionality, which has this wonky .gemspec.rz metadata file that sits alongside the actual gem file. I understand that it'd be a challenging, backwards-incompatible change, but moving this file from Marshal to JSON would break a lot of these gadget chains. Perhaps there would be others, but it would raise the bar.
oof. Quite a bit to digest there. In practice I don't really see how that replaces the process of verifying through another channel to verify that the person on the other side of the conversation is the expected person. It could have been Mallory you've been talking to from the beginning.
Using a very few selected companies as auditors feels like an odd decision. I'd have rather preferred some kind of web-of-trust like CAcert.org does.
And then there is the final nail in the coffin:
> When Automatic Key Verification is turned on, the Signal client periodically fetches Merkle tree heads from the Signal key transparency server. The client requires that each tree head belong to a lineage endorsed by all registered auditors within the last seven days. If the server does not present valid auditor signatures, the client will raise a warning and Automatic Key Verification will fail. A fully malicious server may therefore maintain a split view of the system for at most one week before client applications start to display warning messages.
tl;dr writing exploits still requires expertise, even when you're being aided by an LLM