you can run an inferior model for an infinite number of tokens, and it will never realize(*) that the lack of validation of the start window, if put together with the integer overflow, then put together with the fact the branch where the node should never be NULL is entered regardless, will produce the bug.
作者通过OpenBSD SACK bug的例子提供了一个令人惊讶的发现:弱模型无论运行多久都无法理解复杂漏洞的因果关系。这揭示了AI在理解复杂系统交互方面的根本局限性,挑战了'无限计算可解决任何问题'的假设。