Definition
Plain language
A weak spot in software that someone could abuse to break in or cause harm.
As stated in the literature
A defect whose exploitation violates a security property; the key feature exploited here is that many vulnerabilities are functionally silent, passing all correctness tests.
Also called: vulnerabilities
Why it matters: Most vulnerabilities pass every functional test without complaint, so a system that only checks whether code works will ship them happily.
For example, code that builds a database query by pasting user input straight into it works perfectly for normal users and hands the whole database to anyone who types the right punctuation.
Heard on the show
“The author notes that the techniques are already public, and the paper isn't introducing a new vulnerability so much as making it legible.”Episode 004 — The Sycophancy Circuit That Survives Alignment Training