saw a post arguing that Mythos was used to audit PHP and still missed the pre-auth RCE, and that a lot of the frontier-lab fearmongering around these models is overstated.... pretty much agree.
been writing about this for time AI is decent at local / taint-style bugs or single primitives but still weak on the ones that only exist in composition/topology. this is why the bounty programs is now only profitable for bug hunters who were in the game before AI.
AI mostly thinks in lists. it reads functions, follows a few calls, and looks for obvious sinks. it doesn’t really build or reason over the actual call graph + system model of how state moves across components and request boundaries like a human would. Trail of Bits are actually the only people i see solving this with trailmark.
#PHP2Shell is a clean example of this logic. multipart parser + upload-progress bookkeeping + unserializer state etc etc. the individual pieces don’t contain an obvious local “this is broken” defect. the problem only appears when you connect them.
the bug isn’t “line X is bad.” it’s that the request lifecycle + exceptional control flow + worker reuse create a state machine where trust assumptions break across the boundary. same shape as the topology cases i previously described.. hard to see in one place, only appears when you model the whole sequence.