Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US summons bank bosses over cyber risks from Anthropic's latest AI model

theguardian.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#51

Post by lamasery »

__natty__ wrote: post #31

I wonder whether this kind of release of model could become the spark that ignites a new digital "cold war" between us, europe, india and china, in which they will try to outwit their rivals and compromise their critical infrastructure using artificial intelligence. Also I’d like to believe that this really is such a huge step forward compared to Opus, but lately I’ve found it hard to believe when I look at the state…

Connecting so much stuff to the network was always crazy. Ditto computerizing so much, some yes, but as much as we have? Horribly risky.

I doubt we'll see a shift away from "everything's on the network!" because it's so incredibly beneficial to the surveillance state, but one can hope.

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#52

Post by sdwr »

pixel_popping wrote: post #8
causal wrote: post #6

Maybe it's marketing, but I think it's regrettable that Anthropic paired project Glasswing with Mythos. It really makes it seem like Mythos is the threat, rather than the fact that tons of vulnerabilities have always been ignored throughout the software world. If Glasswing has been started years ago with the goal of applying fixes to AI-found gaps, then this would just be another model to add to that effort. But doin…

Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about. Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to acces…

Recklessness is based on effort, likelihood, and consequence. If you live in a small town, you might not lock your front door. No matter where you live, you probably don't lock your second floor windows.

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#53

Post by pixel_popping »

LunaSea wrote: post #46
pixel_popping wrote: post #8

Earlier quoted context omitted.

Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about. Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to acces…

Highly disagree. It's most of the time a question of management not caring about security or disliking the inconvenience that security can bring.

I agree as well, however for example for FOSS projects, it's exactly as you say, an inconvenience to secure and we comeback to the "I pray that no one exploit X".

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#54

Post by pixel_popping »

sdwr wrote: post #52
pixel_popping wrote: post #8

Earlier quoted context omitted.

Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about. Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to acces…

Recklessness is based on effort, likelihood, and consequence. If you live in a small town, you might not lock your front door. No matter where you live, you probably don't lock your second floor windows.

Are we doing enough effort tho, AI era invites us to get our shit together as well, we are all guilty of it, but we must also understand that if you live in an area with a high crime rate, you adapt and lock your door, the same must be applied online now that we will have 24/7 rogue agents with sole purpose of doing ransoms and attacks of all kind.

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#55

Post by specialist »

snovymgodym wrote: post #48
pixel_popping wrote: post #8

Earlier quoted context omitted.

Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about. Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to acces…

> it mostly boils down to recklessness of developers I disagree. I think in big tech and the corporate world, it boils down to the organization fundamentally not valuing security and punishing developers if they "move slow", which is often the outcome when you maintain a highly security-oriented process while developing software and infrastructure. When big leaks happen, the worst that occurs is that some trivial fin…

Last gig I had that took QA/Test seriously was late '90s. I have no hopes the situation will improve, for quality or security, until something fundamental changes.

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#56

Post by giantg2 »

pixel_popping wrote: post #8
causal wrote: post #6

Maybe it's marketing, but I think it's regrettable that Anthropic paired project Glasswing with Mythos. It really makes it seem like Mythos is the threat, rather than the fact that tons of vulnerabilities have always been ignored throughout the software world. If Glasswing has been started years ago with the goal of applying fixes to AI-found gaps, then this would just be another model to add to that effort. But doin…

Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about. Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to acces…

"Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about."

I agree that cyber security is taken too lightly. However, I think that many developers don't actually know about vulnerabilities. In many companies those reports get filter through other teams and prioritized by PMs. The devs tend to do their best at meeting the afressive schedules the penny pinching business people set.

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#57

Post by LunaSea »

pixel_popping wrote: post #53
LunaSea wrote: post #46

Earlier quoted context omitted.

Highly disagree. It's most of the time a question of management not caring about security or disliking the inconvenience that security can bring.

I agree as well, however for example for FOSS projects, it's exactly as you say, an inconvenience to secure and we comeback to the "I pray that no one exploit X".

FOSS projects are a different beast since contributors are working for free and no contributors might have the time to fix a security bug or review a PR fixing one.

I might add however that most companies use FOSS projects without paying for or contributing to them.

The onus is still on the final user to make sure that the code they use is safe.

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#59

Post by matheusmoreira »

pixel_popping wrote: post #8
causal wrote: post #6

Maybe it's marketing, but I think it's regrettable that Anthropic paired project Glasswing with Mythos. It really makes it seem like Mythos is the threat, rather than the fact that tons of vulnerabilities have always been ignored throughout the software world. If Glasswing has been started years ago with the goal of applying fixes to AI-found gaps, then this would just be another model to add to that effort. But doin…

Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about. Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to acces…

> recklessness of developers

Nah. It's the corporations that could not care less and therefore do not reward careful work. They care about nothing but time to market. Start stacking legal and financial liability and I guarantee they are suddenly going to start caring a lot.

Re: US summons bank bosses over cyber risks from Anthropic's latest AI model

#60

Post by cheschire »

lamasery wrote: post #51
__natty__ wrote: post #31

I wonder whether this kind of release of model could become the spark that ignites a new digital "cold war" between us, europe, india and china, in which they will try to outwit their rivals and compromise their critical infrastructure using artificial intelligence. Also I’d like to believe that this really is such a huge step forward compared to Opus, but lately I’ve found it hard to believe when I look at the state…

Connecting so much stuff to the network was always crazy. Ditto computerizing so much, some yes, but as much as we have? Horribly risky. I doubt we'll see a shift away from "everything's on the network!" because it's so incredibly beneficial to the surveillance state, but one can hope.

Admiral Adama has entered the chat.
Post reply on HN