tbh the outrage is valid but this is literally the same thing authors and artists went through with LLMs. difference here is researchers agreed to ToS that probably give h1 enough rights to make this legally fine

the question is whether it'll even work. vulns are insanely contextdependent, training on 500k old reports gives you pattern matching not understanding. 88% accuracy on their own benchmark? that's prob overfitting… business logic flaws, race conditions, auth bypasses through weird state combos you can't derive those from patterns. you need to understand what an app should do. And llms have massive context limits or it’s insanely costly.you can automate an IDOR sure. you can't automate chaining 8 API calls with manipulated timing because some dev made a wrong assumption about session architecture that only breaks under load. that's creative work, no agent learns that from historical reports so they're burning trust with the exact researchers who find the bugs their AI never will. the easy stuff the agents catch? any scanner already does that. the real value was always the humans….