Glen Fiedler, a seasoned network expert and a leader of game companies in the past like Network Next, is warning game coders to fix the security bugs in their code because AI can now find those bugs.
In particular, on the warning from a friend, Fiedler used Anthropic’s latest version of Claude AI programming tool, Claude Code Fable 5, to review his code. In a post on LinkedIn and an exclusive interview with GamesBeat, Fiedler said he has been a hardcore AI skeptic.
Until now.
“I passed Claude (Code) Fable 5 over my network libraries starting Monday last week. Starting at 11 p.m., I was up all night until 6 a.m., and have been working non-stop since then to fix everything up,” Fiedler posted a few days ago on LinkedIn. “There is something massive coming. First, AI coding is real and it’s going to expose massive security flaws. in game libraries (like my own) that were 10 years old and I thought were completely secure.”
Now he has finished working on fixing security bugs found in my open source networking libraries, used by many games and middleware products, with the help of his new AI companion. And he’s warning as many of his colleagues in the industry to do the same.
Fiedler, who is based in New York, has been a big skeptic of generative AI and told game developers to stay away from it. But he now says, “AI coding is real, and it’s going to completely and radically change the game industry forever. Those who don’t agree just haven’t been hit by the shockwave yet. I was a total skeptic of AI two weeks ago and now I am a true believer. It’s real. All of it.”
Fiedler is still working on a game, with a focus on putting a thousand players into a single battle.
The good news is that developers can upgrade their code with the help of Claude Code Fable 5. It cost him about $5,000 worth of AI tokens to do so over two weeks, but it would have taken him 10 times longer or more coding time if he had not used the AI helper to get it done. Fiedler has been able to fix his code without having to do the fixes himself.
“I am disclosing this not because my libraries are shit, they were actually the most secure in the industry probably. It’s just that Claude Code Fable 5 is just on another level. All my libraries are secure now with new releases as of today,” he said.
He posted some details here (where he is recouping some of the cost with Patreon). Fiedler said Claude Code Fable 5 has found significant bugs in netcode, reliable, serialize and yojimbo open source libraries. These libraries are used in many games. If you are using these libraries in your game or middleware packages, please upgrade to the most recent releases of these libraries immediately, Fiedler wrote.
Do not use old versions of these libraries!
Get the latest versions of these libraries here:
- https://github.com/mas-bandwidth/netcode
- https://github.com/mas-bandwidth/reliable
- https://github.com/mas-bandwidth/serialize
- https://github.com/mas-bandwidth/yojimbo
Full list of fixed bugs here: https://github.com/mas-bandwidth/patreon/blob/main/BUGS.md
Fiedler said he got a tip from Brian Bucklew, who is one of the authors of Caves of Qud, about how Fiedler should check out Claude Code and run a best about how Fable 5 could locate any bugs in Fiedler’s own open source libraries. The message came in at 11 p.m. at night, and Fiedler stayed up all night and “continued two weeks of being completely frantic.”
In a message to GamesBeat, Bucklew said, “I think it’s clear we’re in the middle of a security arms race and it’s going to have downstream impacts on games and its foundational libraries and engines (Glenn clearly shows that it already is having that impact, it’s not in the future). I’m not sure how that’s going to impact people’s currently extreme views on it, if at all. The current public discussion allows for no nuance and is hyper polarized (perhaps reasonably so, but nonetheless).”
Fiedler himself has been vehemently against AI in gaming.
“I saw this to my for myself. I’m a 100% militant anti-AI skeptic,” Fiedler said. “I felt up to that point that AI was just another another thing in a long chain of like NFTs, blockchain, Web 3, game streaming, meta-you know all the bullshit, right? Like all the bullshit that people have been trying to push into the game industry for for a decade plus.”
Some of Fiedler’s industry colleagues agree with Fiedler about the urgency to act fast to fix code. Mitchell Patterson Jr., studio director at Wolfjaw Studios, in a message to GamesBeat.
“I agree. I was actually chatting with a friend who’s a game designer earlier about this exact topic. The current AI situation allows us to do a lot more but it’s also opening us up to many vulnerabilities. I agree with Glenn that being cognizant of these potential security issues and tackling them are very important. This is especially true in games where trade secrets are precious,” said Patterson Jr. “Just to be fully upfront. I am very pro-AI when it comes to utilization and empowering the right developers with it. But also ensuring that security isn’t just being ignored.”
And Dean Hall, CEO of RocketWerkz, said in a message to GamesBeat, “Glenn is in my opinion one the most experienced people for multiplayer architecture in games. Multiplayer PvP has long been essentially an arms race where developers are always on the losing side. So developers are going to need to get extremely creative when trying to patch the issues that will be coming up now.”
By lumping AI in with the over-hyped trends like the metaverse or blockchain, Fiedler said he made a mistake.
He said he felt, “Well, this obviously doesn’t work. Why are they doing this? And I put AI in that same basket, and honestly, I was wrong. And I think you can look at the fixes that I found on these libraries that I’ve worked on. That I mean, it literally is netcode that goes all the way back in spirit to the netcode I wrote for Journey, right? And some of the netcode I worked on for God of War. These are the same sort of libraries in an open source form that I wrote after I stopped working on Titanfall.”
He added, “I started taking a lot of stuff and putting it into these open source libraries. I put everything I had in it. They’re more than 10 years old at this point. They’re in hundreds of shipped games, and they’ve been insecure for 10 fucking years. And and I’m not bad at my job. I’m actually probably a world expert in netcode and in these libraries, and they’re probably some of the better libraries that are out there. And I fully thought that they were secure. You know. Yeah, it kicked it kicked my ass, man.”
It was a relatively simple prompt that Fiedler asked of the Anthropic AI that uncovered the problems.
“It came to the table with a massive amount of intelligence around overruns. It correctly determined that this was an area of code that’s reading in data from the network, and it couldn’t be trusted,” Fiedler said. “It was correctly tracking down like this could cause a crash.”
He added, “Then somebody as as a game programmer or an attacker could point it at the client, or could point it at the server and break encryption on a game console and root the console. Someone could crash a game server at will. Somebody could make a player’s server crash, like a player’s game crash. There’s going to be a lot more like this because the class of the bugs that are being found are things that can be remotely executed from the network, breaking or crashing the game server or the game client or both.”
Fiedler said, “Every single person who works on networking code in the game industry right now has to work around this with their software, and this also applies to game backends for any purpose, game code that reads anything from the network, or even any data that’s untrusted.”
For those software makers and game companies using Fiedler’s open source libraries, they have to just update their software the the latest versions that Fiedler has made available.
He advised that game makers have to run Fable 5 on their game codebase and backend codebase. To make fixes, Fiedler created an AI helper that can create the code he needs to fix problems. Fiedler said the AI knew things that he didn’t and it is “absolutely boundless.” Fiedler can teach it some things as well, and he noted AI would go to extremes he would never try because of the length of time AI can dedicate to mundane tasks.
“The AI coding thing is real,” Fiedler said. “I still don’t like shitty generative images. AI is still not going to make a movie you’re going to watch. AI is not going to make a game. But my God, for every discipline, there’s going to be an AI 100x improvement coming, and it’s like a fucking massive shockwave coming. It just hit me two weeks ago.”
Of course, given the unpopularity of AI in gaming, among both developers and players, Fiedler believes that many people aren’t admitting that they’re using AI for programming.
“Every OS. Every piece of software, every library ever written, every game ever written, every multiplayer game is now vulnerable to what I just found and fixed;” Fiedler said. “Honestly, this is a wake-up call. If you work on software or libraries used by games in any way, and they read in untrusted input from the network or from the disk or anything, it is now mandatory that you run this tool over your codebase and you ask it, ‘Please audit this codebase and tell me any bugs you find.’ And you’ve got to do that with the latest Claude Code with Fable Five turned on in the ultra code mode, where it does the most effort to find things.”
Fiedler said he consider this mandatory now.
“I would not trust any software that doesn’t do this. I wouldn’t use an OS. I wouldn’t. I wouldn’t ship a game that doesn’t do this. And this is this is a shockwave. Like it’s not going to spread out at the same speed. Not everyone’s going to notice it. There’s going to be more disclosures,” Fiedler said.
If human programmers don’t pay attention, Fiedler said “real damage” will start being done.
“Games will be taken down, servers will be taken down, backends will be down. People need to fix their shit ASAP. And and even if you have a stance against generative AI, like like I did, even if you think like I do, like respect the artist, say no to AI-generated art. I feel that way too. I just have caution now,” he said.
Fiedler said he was astounded at the competence of the AI collaborator he created. The challenge with using humans for the fixes is that these games could use hundreds of libraries from many different authors.
“This thing is so competent that game engines are no longer going to be a thing. Instead, it’s going to be libraries that people use AI to come in and merge and make the specific engine and everything for the game. And I would two weeks ago I would have said that’s absolute horseshit,” he said.
And the same tech that enables the AI helper is the same that the bad guys will use to track down the vulnerabilities in software. It becomes a cat and mouse game, Fiedler said.
“We need to get the word out,” Fiedler said. “I was a skeptic. I was wrong. It’s real.”