The invisible dragon discovered magical security vulnerabilities but they go to another school

Suppose someone tells you that they’ve discovered a magical new treatment to a common but unpleasant illness. The socially agreed way which we verify whether this is true includes doing a randomized controlled trial under double blind conditions, then writing up the results of said trial in a scholarly article for publication in a high-quality peer reviewed scientific journal. When someone eschews that process in favour of, say, posting on social media, and appearing on a popular podcast like The Joe Rogan Experience, those outside the discipline are highly justified in drawing a negative inference as to the quality of the underlying data. If you really did have the data to show that your particular flavour of magic beans worked, you’d find the evidence, publish it in a respected academic journal and grab a whole load of prestige (up to and including the ultimate bragging rights, a Nobel Prize).

Suppose someone tells you that they’ve discovered a magical technique to trade on the stock exchange that is a foolproof money spinner and will beat the crooks at Barclays and JP Morgan Chase at their own game. If this were true, why would they not just run the system using their own capital and reinvest the returns and become the next Warren Buffett? Why are they trying to use cultish high pressure sales techniques to upsell you to a course that costs £997 in a dingy Premier Inn? That negative inference machine we were building? Set it to “I can’t believe it’s not fraud!”

Suppose some company tells you that they’ve built an artificial intelligence system that’s so powerful it has found all sorts of bugs that nobody else could have found, and broke its own programming. The appropriate next question would be “so, you responsibly disclosed the problems to the original developer or vendor then registered it with a vulnerability database like the NVD, and had it assigned a CVE number?” Because that’s how computer security research is done. You find a vulnerability, you file a CVE. Partly because the entire industry has built systems for propagating the fixes for security problems through the NVD/CVE/CVSS infrastructure, but also because filing some CVEs gives you some bragging rights.

If, instead of responsibly disclosing the vulnerabilities and filing CVEs, said company briefed the press and had it written up in generalist news and business media outlets like The New York Times, The Economist and CNBC, hyped up “what does it all mean?” thinkpieces on Substack and LinkedIn, and used it to justify various marketing and/or policy goals the company is pushing for, you might be very entitled to draw a negative inference that what you are reading may be as believable as the magical cure-all or the trading algorithm or the faith healer’s miracles, or the amazing network marketing opportunity in your downline selling overpriced vitamins or mouldy leggings.