jvbotelho

There is also this paper that says that this AI loop makes the security worse getting almost 40% rise of vulns after just 5 iterations https://arxiv.org/html/2506.11022v2

And we should also look at the security perspective, Devs with AI produce 10x more "security findings" (https://www.theregister.com/2025/09/05/ai_code_assistants_se...)

Another report says that AI code has 3 times more vulns then human ones with 45% being related with the OWASP top 10 (https://www.veracode.com/blog/genai-code-security-report/)

Im personaly waiting the hype pass and some analysis/explanation be done or posted somewhere, for now im pretty skeptical, worth noting OpenAI is still unprofitable and with the whole fuss about anthropic's mythos and etc i'd take it with a grain of salt, as far as i've read about, it seems that was a human error result, bad isolated infra (it was supposed to be isolated from the internet) + "unlimited" tokens to the model run on

im developing some FOSS cybersec tools lately and im getting some nice feedback so it motivates me, the tools are

Skewrun -> a tool that solves the Kerberos KRB_AP_ERR_SKEW (Clock Skew Too Great) error, allowing you to run tools like Impacket or NetExec from a Linux attack machine whose clock is heavily desynchronized from the target Windows domain, without requiring root privileges to change the system time. (https://github.com/JVBotelho/skewrun)

GhostHound -> an Bloodhound opengraph lib that deals with Tombstone reanimation as a BloodHound attack path, enumerating CN=Deleted Objects and who can restore them (https://github.com/JVBotelho/ghosthound), this one even landed in Bloodhound's documentation as community lib

as colesantiago said, you did it for "free", almost anyone can do the same, and it seems you just build "yet another ai wrapper", so whats the value for your user?