So I guess everyone uses LLMs to think now

What it claims

The eva.ac author argues that the recent run of AI-credited vulnerability findings comes from skilled researchers steering LLMs, usually at large firms with unlimited tokens. The author also argues that AI companies now use security disclosures as marketing. The author's own research uses no AI at all. Their stated reasons: the work is done for fun, model output cannot be credited, and watching a model be "confidently wrong" is intolerable. The author accepts that LLMs are powerful but says they are marketed as more capable than they are. Their example: an unguided LLM pointed at the Linux kernel probably could not find an RCE.

Evidence

PHP2Shell. Calif, OpenAI and Wiz each published their own post on the same PHP vulnerabilities, with different framings:

• Calif described an AI finding the bugs with a human guiding it.
• OpenAI said its agent "uncovered critical vulnerabilities."
• Wiz took a middle position that the author reads as close to OpenAI's.

OpenAI said it helped maintainers patch faster. The author argues OpenAI had the compute to backport fixes to older PHP versions and did not.

Pre-patch teasers. The author argues two practices are marketing that harms security:

• PoC videos of unpatched 0days, which leak useful detail however much is hidden.
• Hashes posted next to a product name, which signal that a vulnerability exists without saying what it is.

Tailworm. A researcher posted a hash on Bluesky captioned "tailscale privilege escalation." Details came out in a thread over the next two hours. The next day, the researcher's one-person company published a findings website. The author calls the site vibe-coded and says most of its findings are not critical. The privilege escalation was real but narrow: it needs existing ACL access to a machine with Tailscale SSH enabled, and then allows escalation to root on that machine. The author says Tailscale was not contacted before publication.

eMudhra. The CA private key that turned out to be the number four was found without AI. A person found it by scanning keys out of curiosity with Google's paranoid_crypto library. The author calls this the biggest finding of the period and notes that AI efforts had missed it.

Limits

This is an opinion piece. It links no sources, dates or CVE identifiers for PHP2Shell, tailworm or eMudhra. The tailworm scope and the claim that disclosure was skipped are the author's account and are not verified on the page. The page gives no data on how well LLMs perform in security research beyond the author's own brief, unpublished experiments.