So I guess everyone uses LLMs to think now

The writer rejects using LLMs for personal research and creative projects because hands-on investigation is the enjoyable part: coding, tracing unfamiliar libraries, debugging, and reverse-engineering. Offloading even tedious tasks can feel dishonest when publishing work as their own, and experiments with models have been frustrating because they confidently make mistakes or take foolish steps. The writer does not deny that LLMs are powerful, but argues they still depend on experienced people to guide them; they cannot simply be pointed at a large codebase and expected to discover serious vulnerabilities unaided. Claims about AI-led security breakthroughs often obscure the researchers’ expertise and the resources behind the work.

The writer also criticizes security companies for turning vulnerabilities into marketing, sometimes sharing proof-of-concept videos or cryptic hashes before fixes are available, which can create fear without helping defenders. The Tailworm disclosure is presented as an example: a Tailscale privilege-escalation flaw was publicized dramatically, then disclosed without first giving Tailscale a chance to patch it; the flaw required existing access and a particular SSH configuration, making the alarm disproportionate. By contrast, a major eMudhra certificate-authority key failure was found by a person using an older Google library, not AI. The broader point is that tinkering independently builds skill and provides enjoyment that automation can erase. Work pressures may encourage AI use, but personal projects offer space to learn through the process, including dead ends and unexpected discoveries.