Eventually, what will happen with software is what happened with all other engineering disciplines: Regulation, liability (can be personal liability on top of organizational one, we already have some of that in some places) and qualification requirements. And then doing it on the cheap becomes very expensive.

How to fix this on the software side is known: Resilient security via redundancy, i.e. more than one mechanism ensuring each security property. Then a vulnerability is typically not exploitable. That is expensive, slow and takes real engineers to do it. But it is the only way. And eventually it will be enforced.

That or technological debt and maybe comprehension debt (nobody understand things enough to fix them anymore when the AI cannot do it) will eventually cause some really spectacular failure and yes, the end of some large player.

No argument from me about any of that. The concern I have is that many people responsible for code do not understand in which places slop is fine and in which places it is not.

Yes. But that means LLMs are not fit to be used by non-experts. (Which is something I am more and more think is the case, actually.) And the fault for giving non-experts access lies squarely with the LLM sellers and the C-levels in companies pushing their use.

Yes to all of that. Unfortunately the problem has gotten very large by now.

Users do not and cannot understand the issue. They are not IT experts. Tools that make these mistakes too easy are 100% at fault. Blaming the user is just an attempt at shifting blame. Unless IT people finally start admitting that, things are not going to improve.

Are you aware of the history of litigation against Linux?

Not the users, the makers of Claude. (The users just do not know any better and that is entirely expected.) Looks to me like the people at Anthropic have zero clue about IT security and they make pathetic beginner's mistakes. Are these really the people you want to trust with your secrets?

Do you mean the fake AGI with the current definitions the LLM assholes are using? Or real AGI? Because for the latter nobody knows what it would do. It may just put in clever backdoors to give itself access or to give you the finger. On the plus side, nobody with a clue knows whether real AGI is even possible.

LLMs introduce tons of security bugs, unless very carefully prompted. But the skills to prompt like that are the same skills that a regular developer would have needed to not make these mistakes, or find them in review and testing. Well, prompting is actually harder because it is more abstract. Now, available evidence suggests most devs cannot write secure code and that directly means they cannot prompt for secure code either. And an additional problem is that an LLM may screw it up even when carefully prompted due to hallucinations, compression and other effects.

All in all, AI code is slop and will remain slop. If that works for you, fine. If you need more, do not let AI write your code.

Not at all. It is finding vulnerabilities that the devs did not check for, that the devs know about but thought could no be exploited and vulnerabilities that competent tool use would have found much faster and competent software engineering would have avoided in the first place.

This is a straw fire.

Well, I can just walk over to where the doctoral degree hangs on my wall. This makes my _very_ unimpressed with your comment. Funny how people like you do not get that I reliably know I have that degree. Oh, and incidentally, claiming a PhD without having one is a crime here.

You think big actors cannot be sued? Have you even looked at the history of tech lawsuits? Big actors are fat, juicy targets.

That is just special treatment for you. You may ask yourself how that came about ...

Yes, the main difference seems to be that it is different birds for sea and for land.

As usual, you are without clue. This is not the US where corporations can fake research without consequences. Vattenfall would have gotten skewered.