alt Hacker NewsI'm sorry you've possibly been wasting your time, but this lends little credence to the idea that what you've been patching has actually mattered from a security perspective.
If there isn't data available to assess impact objectively, then this is just fluff and nobody has any reason to believe you.
I am unaware of any comprehensive analysis demonstrating that LLMs can identify and exploit problems in private code repositories for major enterprises any more than they do open source technologies, or that this is a growing/mounting crisis. Are you?
The OP gives us substantive reason to believe that Glasswing is fluff propped up by fake metrics, which confirms the suspicions of many people working in the trenches with the technology. I don't know what you're giving me reason to believe.
Replies
You sound like you’ve already made up your mind. Why would anyone waste their time trying to convince you, random internet stranger? It was just someone sharing their personal experience, which you’ve neglected to do, I might add.
I don't think it matters. You have to address it or it just continues to generate noise. People aren't great at predicting what could really be exploitable, so who is going to sign-off on ignoring it at a large company? And there is real risk there - even if only a tiny fraction are truly exploitable in a way that would cause real harm you just don't know which are which.
Personally, I would be absolutely astonished if there were not numerous catastrophic security flaws in LOTS of private codebases in even the best engineering orgs. How discoverable are they without access to the code? Well - how many people have access to that code?