HackerTrans
TopNewTrendsCommentsPastAskShowJobs

jc4p

no profile record

Submissions

I built a vulnerable app and spent $1,500 seeing if LLMs could hack it

kasra.blog
402 points·by jc4p·bulan lalu·216 comments

comments

jc4p
·bulan lalu·discuss
Just saw your edit -- I'm afraid to open source the code before refactoring it but if you reach out at [email protected] I'll send you the full ZIP!
jc4p
·bulan lalu·discuss
Sorry I don't understand, you're saying the direct providers aren't the canonical source you'd recommend?

If I was running these on my own machine or GPU wouldn't the argument then be "Well you didn't use the real providers?"

For the record I started doing this approach because the Kimi team released this which was shocking to me: https://github.com/MoonshotAI/K2-Vendor-Verifier
jc4p
·bulan lalu·discuss
Thank you so much for this detailed answer!! Excited to dig into this world more :)
jc4p
·bulan lalu·discuss
I was using the same harness for each run, the difference is from when I was running the harness locally on my machine before I pushed up the full runs.
jc4p
·bulan lalu·discuss
Great point!

When I found the original exploit in an app I researched it took me around 15 minutes and some assistance from Claude.

For this project I gave myself the weekend + parts of Monday, so around 20 hours of dev time — at my standard rate that’s ~$5,000 of dev time.
jc4p
·bulan lalu·discuss
I agree fully and hope someone else is able to do this test! For me it was a matter of cost and quotas that stopped me from changing to a new account.

Also just to mention:

Claude guardrails —> that session terminated.

GPT guardrails -> your whole account is slowed down.
jc4p
·bulan lalu·discuss
Thank you for your note! As I mention in the post this is not scientific at all.

I'm very curious how you would do multiple runs of multiple models in a "work alongside the model" manner?
jc4p
·11 bulan yang lalu·discuss
Thank you! I’ve been fine tuning tiny Llama and Gemma models using transformers then exporting from the safetensors that spits out — My main use case is LLMs but I’ve also tried getting YOLO finetuned and other PyTorch models running and ran into similar problems, just seemed very confusing to figure out how to properly use the phone for this.
jc4p
·11 bulan yang lalu·discuss
I do a lot of AI work and right now the story for doing LLMs on iOS is very painful (but doing Whisper or etc is pretty nice) so this is existing and the API looks Swift native and great, I can't wait to use it!

Question/feature request: Is it possible to bring my own CoreML models over and use them? I honestly end up bundling llama.cpp and doing gguf right now because I can't figure out the setup for using CoreML models, would love for all of that to be abstracted away for me :)
jc4p
·14 tahun yang lalu·discuss
I'm twenty, I've been programming since I was 13.