Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: Securing critical software for the AI era

anthropic.com

Post reply on HN
Print view View original

601–610 of 921 posts

Re: Project Glasswing: Securing critical software for the AI era

#601

Post by kashyapc »

qnleigh wrote: post #526
ofjcihen wrote: post #508

I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. I would honestly go so far as to say the overhype is detrimental to actual measured adoption.

There is plenty of overhyping, no one denies that. But the antidote is not to dismiss everything. Ignore the words and look at the data. In this case, I see a pretty strong case that this will significantly change computer security. They provide plenty of evidence that the models can create exploits autonomously, meaning that the cost of finding valuable security breaches will plummet once they're widely available.

You seem to see a "pretty strong case" from a bombastic press release.

Don't get me wrong, I do know the reality has changed. Even Greg K-H, the Linux stable maintainer, did recently note[1] that it's not funny any more:

"Months ago, we were getting what we called 'AI slop,' AI-generated security reports that were obviously wrong or low quality," he said. "It was kind of funny. It didn't really worry us."

... "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now."

---

I agree that an antidote to the obnoxious hype is to pay attention to the actual capabilities and data. But let's not get too carried away.

[1] https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_...

Re: Project Glasswing: Securing critical software for the AI era

#602

Post by ACCount37 »

tptacek wrote: post #458
josephg wrote: post #283

To be clear, we don’t know that this tool is better at finding bugs than fuzzing. We just know that it’s finding bugs that fuzzing missed. It’s possible fuzzing also finds bugs that this AI would miss.

This is obviously just cope (there's a long, strong-form argument for why LLM-agent vulnerability research is plausibly much more potent than fuzzing, but we don't have to reach it because you can dispose of the whole argument by noting that agents can build and drive fuzzers and triage their outputs), but what I'd really like to understand better is why? What's the impetus to come up with these weird rationalization…

You said it yourself. It's cope. That's all it is and all it ever was.

https://en.wikipedia.org/wiki/AI_effect

Every time an AI does something new, there's a human saying "it's not really doing that something", "it's doing that something in a fake way" or "that something was never important in the first place".

Re: Project Glasswing: Securing critical software for the AI era

#603

Post by ofjcihen »

ACCount37 wrote: post #600
ofjcihen wrote: post #594

Earlier quoted context omitted.

That feels like a very complex way of looking at it. Another way would be to say “potentially profit seeking companies have an incentive to oversell products even if they’re good”.

[flagged]

Homie chill. I use Opus every day and I love it. I’m not saying it’s all hype, just that these companies are here to make money and that every advertisement should be taken with salt yeah?

Also maybe consider what this kind of visceral reaction indicates on a personal level :/

Re: Project Glasswing: Securing critical software for the AI era

#604

Post by athrowaway3z »

jstummbillig wrote: post #591
ofjcihen wrote: post #508

I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. I would honestly go so far as to say the overhype is detrimental to actual measured adoption.

> how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. It's much the dynamic between parents and a child. The child, with limited hindsight, almost zero insight and no ability to forecast, is annoyed by their parents. Nothing bad ever happens! Why won't parents stop being so worried all the time and make a fuss over nothing? The parents, which the child somewhat star…

This is just a really bad analogy. It doesn't addresses that there are multiple sources, the incentives to be telling us about it, and the spectrum between disaster-mitigation heroes and snake-oil salesmen.

Re: Project Glasswing: Securing critical software for the AI era

#605

Post by 4ndrewl »

kachnuv_ocasek wrote: post #593
4ndrewl wrote: post #569

Earlier quoted context omitted.

Is there any actual independent data though, or verification of any of these claims? As it stands this is just a marketing programme for all involved.

What would be the product they're marketing by this campaign?

You don't market products, you market lifestyles/interests. Sell the sizzle, not the steak etc.

For Anthropic it's "we own the big scary models, the AI security space, but it's ok we're responsible"

For the partners it's "we're the Big Boys here and will look after your enterprise needs"

None of it needs any more than anecdata and some nice, pre-approved, quotes.

Every organisation does it.

Re: Project Glasswing: Securing critical software for the AI era

#606

Post by HALtheWise »

qnleigh wrote: post #536
rootkea wrote: post #459

Earlier quoted context omitted.

> The model autonomously found and chained together several vulnerabilities in the Linux kernel—the software that runs most of the world’s servers—to allow an attacker to escalate from ordinary user access to complete control of the machine.

I'm confused on this point. The text you quote implies that they were able to build an exploit, but the text quoted in the parent comment implies that they were not. What were they actually able to do and not do? I got confused by this when reading the article as well.

They successfully built local privilege escalation exploits (from several bugs each), and found other remotely-accessible bugs, but were not able chain their remote bugs to make remotely-accessible exploits.

Re: Project Glasswing: Securing critical software for the AI era

#607

Post by ACCount37 »

ofjcihen wrote: post #603
ACCount37 wrote: post #600

Earlier quoted context omitted.

[flagged]

Homie chill. I use Opus every day and I love it. I’m not saying it’s all hype, just that these companies are here to make money and that every advertisement should be taken with salt yeah? Also maybe consider what this kind of visceral reaction indicates on a personal level :/

[flagged]

Re: Project Glasswing: Securing critical software for the AI era

#608

Post by jiusanzhou »

The $100M in credits for open-source scanning is the most interesting part here. The real bottleneck was never finding vulns in high-profile projects — it was the long tail of critical dependencies maintained by one or two people who don't have time or resources for serious auditing. If Glasswing actually reaches those maintainers, it could meaningfully reduce the attack surface that supply chain attacks exploit.

Re: Project Glasswing: Securing critical software for the AI era

#609

Post by kubb »

jstummbillig wrote: post #591
ofjcihen wrote: post #508

I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. I would honestly go so far as to say the overhype is detrimental to actual measured adoption.

> how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. It's much the dynamic between parents and a child. The child, with limited hindsight, almost zero insight and no ability to forecast, is annoyed by their parents. Nothing bad ever happens! Why won't parents stop being so worried all the time and make a fuss over nothing? The parents, which the child somewhat star…

It’s more like the abusive parents telling the child that they’ll sell him to the scary man at the bus stop every time they want to coerce the child into doing what they want.

Eventually the child develops disrespect for authority.

Re: Project Glasswing: Securing critical software for the AI era

#610

Post by jwpapi »

ofjcihen wrote: post #508

I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. I would honestly go so far as to say the overhype is detrimental to actual measured adoption.

I agree I can’t open any social media no more
Post reply on HN