I built a tool that monitors commits and tries to detect silent bug fixes. With GPT-5.5-class models, it can identify fixes hidden within otherwise routine commits quite reliably. Obfuscating the code changes enough to avoid detection is difficult.
I have heard of at least one project (c-lightning?) temporarily releasing a closed-source binary as a workaround until users could update safely.
Have you heard of these things called LLMs are that are quite good at reversing changes in closed source binaries?
you can diff binaries in a disassembler, the technique has been used for a long time to discover patched Microsoft vulnerabilities, create exploits and then race the world.
now you can instruct an LLM to do this with MCP...
There are many techniques for making a closed-source binary harder to reverse engineer: polymorphism, symbol stripping, code encryption, packing, and so on. Closed-source binaries at least stand a chance of being effectively obfuscated, unlike open-source code.
and those measures have always been merely annoyances. except for the VM methods which impact performance significantly.
now none of those methods matter as you can just instruct an LLM to bang its head against the wall until the wall breaks.
They still matter in the sense that they impose a cost. In other words, they buy time, which is all the users need before updating.
I'm not sure if the cat and mouse game resolves clearly one way or another. Since the obfuscation can be hardened against LLMs during development.
People are trying to secretly fix bugs?
Yes. The problem with openly releasing a fix for a security bug is that people are not always quick to update their instances. It only takes one black-hat monitoring your releases by some means to dissect the changes, find the hole, and make an exploit that can be immediately used against unpatched systems, and the sudden availability of better automated tools for that makes it a much bigger problem than it was a year or more ago.
Information about the problem then gets released later, once everyone has had appropriate time to get up-to-date. Or not, and we are non the wiser.
Yes, they don't want the vulnerabilities exposed so they ship the fix in secret, contained in unrelated features.
Ah, I guess that would advertise that users of the old version are vulnerable. I was imagining some altruistic contributor trying to sneak in a bug fix past the maintainer.
Yep, this is for maintainers releasing fixes to secretly-reported 0days without tipping off attackers who are looking to exploit a (sometimes very large) install base.