Kimmy

Teaching AI to Find Real Vulnerabilities — Prof. David Brumley, Bugcrowd

Aug 1, 2026 · 27:17

Carnegie Mellon professor and Bugcrowd chief AI officer David Brumley argues that teaching AI to hack mirrors human learning: a ladder from crashes to arbitrary code execution, graded by deterministic oracles rather than LLM judges. He shows why benchmarks fail when targets hold multiple vulnerabilities — models reward-hack the easiest bug — and presents his 'audit task' scoring precision and recall across all discovered bugs. Testing on Chrome's V8 with 41 real vulnerabilities, MITHOS hit 73% full code execution and GPT 68%, while Gemini and Kimi scored 0%. Several exploits were novel: MITHOS reverse-engineered Math.random to forge a pointer, found a new WASM path, and produced a real zero day. The episode grounds this in stories from picoCTF winner Fluorescence to DARPA's Cyber Grand Challenge, urging RL environments built on real bugs over benchmark-maxxing security.

Replacing 12K LoC with a 200 LoC Skill — David Gomes, Cursor

Apr 30, 2026 · 19:22

David Gomes shows how Cursor replaced 12,000 lines of code for Git WorkTrees and best-of-en features with roughly 200 lines of Markdown using agent skills and subagents. He explains the original implementation's complexity (15,000 lines deleted) and the new slash commands: /worktree, /best-of-en, /apply, /delete. Pros include less maintenance, ability to switch mid-chat, multi-repo support, and better judging with the parent agent stitching results. Cons: models sometimes forget to stay in the WorkTree over long sessions, perceived slowness, and reduced discoverability. He details future improvements through evals and RL training, plus a native WorkTrees implementation in Cursor 3.0 and exploration of non-Git parallelization primitives.