“The bad news is that although this one was stopped, many others won’t be. No one patch would be enough, or even a thousand; there are just too many variations on the overall theme”
Our reading, the sentence that was checked:
Many attacks on AI coding tools won't be stopped; not even a thousand patches would suffice given the number of variations.
Assessment: Unresolved No deadline stated on 2026-10-29 Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, LLMs + Coding Agents = Security Nightmare, paragraph 41.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-llms-coding-agents-security-nightmare-fedd64-a1
We recorded 11 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-28. The source may have been edited after 2025-08-17. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Forecast
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No deadline stated
- Deadline state on 2026-10-29
- No deadline stated (the release’s reference date)
From the speaker
- many others won’t be
- No one patch would be enough, or even a thousand
- too many variations on the overall theme
Our interpretation
- The target is attacks exploiting AI coding tools, in the context of prompt injection and tool misuse.
- The ordinary reading predicts numerous successful attack variants despite extensive patching. Many does not necessarily mean most.
- A thousand may be rhetorical emphasis, but it cannot silently be replaced with evidence that a few patches failed.
- A controlled exploit establishes vulnerability at the time of testing; it does not by itself establish malicious exploitation or that the attack will remain unstopped.
- The passage supplies no deadline or conditional antecedent.
Counts as supported if: Documented attack and patch histories establish numerous successful variants after extensive relevant remediation, with evidence sufficient to address the claimed inadequacy of even a thousand patches.
Counts as contradicted if: A broadly applicable fix or independently validated architecture blocks the relevant attack family across the stated scope, undermining the claim that numerous variants necessarily escape patching. Fixing individual vulnerabilities is insufficient.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Did the forecast come true?
Outcome: Unresolved
The record was checked, and the evidence available by the cutoff does not settle it.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No deadline stated
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
Later research supports Marcus's narrower expectation that new attack paths would appear after earlier fixes. IDEsaster's follow-up documents that pattern directly. It also reports that vendors successfully patched many earlier vulnerabilities. Neither finding settles the broader prediction that many attacks will remain unstopped despite even a thousand patches. No deadline was given, and the retrieved evidence does not meet the early-resolution rule.
Limitations
- The evidence concerns researcher demonstrations rather than a census of malicious attacks.
- A vulnerability count is not a patch count.
- Treating a thousand as loose emphasis would make the narrower claim easier to support, but would discard an explicit part of the wording.
Evidence (2 items)
Supports the claim: Ari Marzouk / MaccariTA,
were vulnerable to IDEsaster.
Why it matters here: The researcher reports more than 30 vulnerabilities and 24 assigned CVEs across multiple coding products. This supports the existence of numerous attack paths, but the selected test set does not represent every product or establish a thousand-patch threshold.
- Where
- Key Statistics
- Publisher
- Ari Marzouk / MaccariTA
- Kind of source
- Independent measurement
- Describes events of
- Public from
Supports the claim: Ari Marzouk / MaccariTA,
this mitigation is structurally insufficient.
Why it matters here: The follow-up reports new extension-based attack paths after nearly 30 vulnerabilities were patched across 12 vendors. It supports recurring vulnerabilities after remediation, while the successful earlier patching is material evidence that particular attacks can be stopped.
- Publisher
- Ari Marzouk / MaccariTA
- Kind of source
- Independent measurement
- Describes events of
- Public from
What would settle it
A documented attack-and-remediation history addressing the scale asserted, or an independently validated general defense covering the relevant attack family.
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, LLMs + Coding Agents = Security Nightmare
The bad news is that although this one was stopped, many others won’t be. No one patch would be enough, or even a thousand; there are just too many variations on the overall theme
- Where
- paragraph 41
- Published
- 2025-08-17
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-llms-coding-agents-security-nightmare-fedd64-a1: Current. Outcome: Unresolved. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-llms-coding-agents-security-nightmare-fedd64-a1.