Comment by xiphias2 | Hacker News Reader

Comment by xiphias2 | Hacker News Reader

,,GPT‑5.3-Codex is the first model we classify as High capability for cybersecurity-related tasks under our Preparedness Framework , and the first we’ve directly trained to identify software vulnerabilities. While we don’t have definitive evidence it can automate cyber attacks end-to-end, we’re taking a precautionary approach and deploying our most comprehensive cybersecurity safety stack to date. Our mitigations include safety training, automated monitoring, trusted access for advanced capabilities, and enforcement pipelines including threat intelligence.''

While I love Codex and believe it's amazing tool, I believe their preparedness framework is out of date. As it is more and more capable of vibe coding complex apps, it's getting clear that the main security issues will come up by having more and more security critical software vibe coded.

It's great to look at systems written by humans and how well Codex can be used against software written by humans, but it's getting more important to measure the opposite: how well humans (or their own software) are able to infiltrate complex systems written mostly by Codex, and get better on that scale.

In simpler terms: Codex should write secure software by default.

Is "high-capability" a stronger or weaker claim than "team of phd-level experts"?

https://www.nbcnews.com/tech/tech-news/openai-releases-chatg...

much stronger

Don't forget that is also Harder, Better, Faster.

That’s just classical OpenAI trying to make us believe they’re closing on AGI… Like all « so called » research from them and Anthropic about safety alignment and that their tech is so incredibly powerful that guardrails should be put on them.

>Our mitigations include safety training, automated monitoring, trusted access for advanced capabilities, and enforcement pipelines including threat intelligence.

"We added some more ACLs and updated our regex"

I heard the other day that every time someone claps another vibe coded project embeds the api keys in the webpage.

I wonder if this will continue to be the case.

Please no, I don’t need my quick prototypes hardened against every perceivable threat.

In most cases security is not a matter of adding anything in particular, but a matter of just not making specific types of mistakes.

Maybe I'm being dumb but that reads very contradictory? I would say that security is explicitly a matter of adding particular things.

Not an OP, but seems like you might be talking about different things.

Security could be about not adding certain things/making certain mistakes. Like not adding direct SQL queries with data inserted as part of the query string and instead using bindings or ORM.

If you have insecure raw query that you feed into ORM that you added on top - that's not going to make query more secure.

But on the other hand when you're securing some endpoints in APIs you do add things like authorization, input validation and parsing.

So I think a lot depends on what you mean when you're talking about security.

Security is security - making sure bad things don't happen and in some cases it's different approach in the code, in some cases additions to the code and in some cases removing things from the code.

Is there ever a reason to store passwords in plaintext instead of as a hash? Even in a prototype.

The better question is which LLM is going to make such a basic mistake?

Reply on news.ycombinator.com