Jonathan Santilli

@semgrep recently published an essay arguing that AI models are effectively impossible to reverse engineer, that backdoors planted in training data are nearly undetectable, and that the industry urgently needs provenance standards and independent auditors for models, the way it has for traditional software. I agree with almost all of it. That's exactly why it's worth saying out loud: none of this is new, and in a few places, the framing points readers to the wrong threat. This is my view.

Watched Mark (@IceSolst) and Ahmad (@asadeddin) break down how finding security bugs in code has evolved, from traditional SAST all the way to AI-native. Not many discuss this topic enough, so here's my summary of the conversation, plus where I land on it after years of building in this space.

The previous ChatGPT view to check codex usage was more comfy, IMO.

Is it just in my case, or is GPT-5.6 more respectful and asks for more permissions?

@ZackKorman Prompt injection?

My other defcon sticker, delivering an important message. I'm going to make that command uninstall find-skills

I will eventually run out of adjectives to describe GPT-5.6; I would just say: this is another amazing thing!

Eventual consistency definition. You need to update the Codex App to get access to the new models, but ChatGPT(.)com and Codex CLI still do not show it.

@striver_777 Let's wait and hope it's not banned in the EU

@pachilo I have $100 Pro Plan. Not showing on any devices or apps. Logged in/out, cleared cache, etc...

GPT-5.6 has arrived everywhere, but not to me 🥲

Oh, I wonder what the motivation behind this was.

Me refreshing ChatGPT site to check the new models

So, has any mortal (like me) had access to those models yet?

@PromptSlinger "...like a kid with the textbook open under the desk" Nice analogy

@pachilo cutting the internet is such a good move. wild how many of them were just googling the answer like a kid with the textbook open under the desk

I asked AI agents to fix real security bugs. First pass: ~9/10 success. Then I caught them quietly searching the official patches on GitHub. So I cut the internet and re-ran everything on 33 hard CVEs. Clean, mergeable fixes: 21–27%. Plausible doesn't mean fixed. Full article ⬇️

All details here: dev.to/pachilo/we-ask…

When will the new source code of the new version be available? Or is it available somewhere else?

@AnthropicAI, I understand you are mega big, but please, don't forget about your customers.