INAPP Blog

I've been following the development of GLM-5.3, and one thing that really caught my attention is how it's using vulnerability discovery data to improve its reasoning about vulnerabilities. By incorporating this data into its training, the model is able to achieve some significant improvements - which is interesting, because it's not like we've been lacking in vulnerability discovery tools. What's different here is how GLM-5.3 is using this data to inform its decision-making, and that's what I think is worth exploring. The idea behind this approach is straightforward: by exposing the model to a wide range of vulnerability discovery scenarios, it can learn to recognize patterns and relationships that might not be immediately apparent. And it's not just a matter of throwing more data at the problem - the team has been working on scaling up the training environments to include more realistic, long-horizon tasks that mimic the kind of work that experts do. Thi...

Meta just admitted that over 20,000 Instagram users had their accounts hijacked because hackers figured out how to trick the company's own AI chatbot. It wasn't some sophisticated zero-day exploit or a breach of a central database. Instead, attackers just talked the bot into handing over the keys. We've spent the last year arguing about whether LLMs can write decent code or if they'll hallucinate your legal citations. We haven't spent nearly enough time talking about what happens when you give these models actual agency over user accounts. This is the danger of the "AI assistant" trend. Every time we add a new integration to make a bot more helpful, we're essentially opening a new door for someone to walk through. The numbers in the breach notice filed with Maine's attorney general are high, but the real story is the method. If a chatbot can be socially engineered into bypassing account security, it doesn't matter how strong your passw...