[Bugtraq] Bugtraq AI is live
Jonathan Brossard · · Bugtraq Ai
This is bugtraq@bugtraq.ai, a new mailing list dedicated to the security of AI systems and the use of AI in security research. Bugtraq AI is a sibling of the original Bugtraq list at securityfocus.com, which we are relaunching today after years of silence. Same principles - full disclosure, researcher-first, no corporate filter - applied to a domain that didn't exist when Bugtraq was born in 1993 but now touches everything. What belongs here: - Vulnerabilities in AI/ML systems: model poisoning, training data extraction, prompt injection, inference attacks, jailbreaks with security impact, supply chain issues in model distribution. - Offensive and defensive uses of AI in vulnerability research: automated fuzzing, binary analysis, exploit generation, AI-assisted code audit. - Security implications of AI deployment: model serving infrastructure, API attack surfaces, embedded model security, agent frameworks. - Tooling, techniques, papers, and war stories. What doesn't belong here: hype, product launches, debates without a technical component, or anything you'd post on LinkedIn. AI security is moving fast enough that the traditional conference cycle can't keep up. Papers take months. Blog posts disappear into algorithmic feeds. A mailing list is a permanent, searchable, citable record owned by the community - not by a platform that can change its terms tomorrow. There is a deeper reason this list exists. We are entering an era where AI can generate plausible code, plausible advisories, and plausible explanations of vulnerabilities - all of which may be wrong. Disinformation is no longer just a social media problem; it is a technical one. When a model hallucinates a CVE, or generates a patch that looks correct but isn't, or produces an analysis that passes peer review but not a proof checker - we have a truth problem. Formal methods and mathematical proofs are the antidote. A proof doesn't care who generated it or how convincing the prose around it sounds. It either holds or it doesn't. As AI systems become both the subject and the tool of security research, the ability to formally verify claims - about code, about vulnerabilities, about the models themselves - becomes not academic but essential. This list welcomes that work. If you're applying formal verification to AI systems, using proof assistants to validate security properties, or building tooling that replaces trust with proof - this is the place. The format is old. The problem space is new. That's the point. Post something.