They (Anthropic) really did scare the shit out of them. Didn't they.
US summons bank bosses over cyber risks from Anthropic's latest AI model
81–90 of 101 posts
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#82I wonder whether this kind of release of model could become the spark that ignites a new digital "cold war" between us, europe, india and china, in which they will try to outwit their rivals and compromise their critical infrastructure using artificial intelligence. Also I’d like to believe that this really is such a huge step forward compared to Opus, but lately I’ve found it hard to believe when I look at the state…
Connecting so much stuff to the network was always crazy. Ditto computerizing so much, some yes, but as much as we have? Horribly risky. I doubt we'll see a shift away from "everything's on the network!" because it's so incredibly beneficial to the surveillance state, but one can hope.
I used to play some games with this theme when I was a kid: the Mega Man Battle Network series. The very first stage in the very first game, some dude social engineers his way into your house, hacks your inexplicably internet connected oven and nearly burns your entire family down. By the next game, terrorist netmafias are gassing children, nuking dams and hacking airplanes fully intending to crash them with no survivors.
I love computers so much but sometimes I do think they were a mistake.
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#83Earlier quoted context omitted.
Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about. Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to acces…
"Cybersecurity is taken too lightly and it mostly boils down to recklessness of developers, they are just "praying" that no-one act on the issues they already know and it's something we must start talking about." I agree that cyber security is taken too lightly. However, I think that many developers don't actually know about vulnerabilities. In many companies those reports get filter through other teams and prioritiz…
Business managers sometimes make bad decisions (at least in retrospect) around budgets and priorities. But the reality is that there are a limited number of pennies, and if someone doesn't pinch them then there are no pennies left to pay developers.
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#84Maybe it's marketing, but I think it's regrettable that Anthropic paired project Glasswing with Mythos. It really makes it seem like Mythos is the threat, rather than the fact that tons of vulnerabilities have always been ignored throughout the software world. If Glasswing has been started years ago with the goal of applying fixes to AI-found gaps, then this would just be another model to add to that effort. But doin…
I'm particularly interested if someone with relevant expertise could comment on the types of bugs Mythos found, e.g. the 27 year old OpenBSD bug.
I ask because the media around Mythos is leaning into the "Mythos is a super intelligence that can find bugs that no human can" story. But in my mind it's pretty obvious that any software that is complex enough will have a lot of lurking zero days, and better tools will asymptomatically find more of them. So it seems to me something like Mythos would just be able to do more analysis/searching for bugs at a much faster rate than previously possible. But I'm skeptical that the bugs that were found required an insane amount of analytical abilities to locate, so would really appreciate if someone could comment on that (e.g. was it "yeah, with enough time we would have found it eventually" vs. "Wow, this was an insanely difficult bug to find in the first place")
I do agree that medium/long term that tools like Mythos will be a huge boon for cyber security, because it will inherently make it easier to write bug-free code in the first place. But yeah, we're now at a point where all these "pre-AI bugs" need to be fixed and patched before folks in the wild find all these zero days.
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#85Earlier quoted context omitted.
> the government banning it from being released by executive order. There's no legal mechanism for the president or the government at all to do that.
Of course there is. Fully automatic weapons are banned. Certain chemicals and biologics are banned. Certain hacking tools are banned (DMCA): > The “tools” prohibitions, set out in sections 1201(a)(2) and 1201(b), outlaw the manufacturing, sale, distribution, or trafficking of tools and technologies that make circumvention possible. These provisions ban both technologies that defeat access controls, and also technolog…
Those things were made illegal by Congress, not by a president's executive order, which is what this thread is about.
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#86Tangentially related, but how does one protect themselves against the bank account/brokerage being hacked? Can you print out a proof of funds/securities owned to take to court to be made whole?
Aside from FDIC’s insurance, nothing.
And if banks get hacked and money gets wired out - maybe we’ll come up with ways to roll back the damage.
Who knows - this is new territory.
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#87> A recent leak of Claude’s code prompted the startup to publish a blogpost at the beginning of the month saying that AI models had surpassed “all but the most skilled humans at finding and exploiting software vulnerabilities” [...] I've seen a bunch of people conflate the Claude Code source-map leak with the Mythos story, though not quite as blatantly as here. I'm confident that they are totally unrelated.
I have a pet theory that the uptick in normal cybersecurity PRs you mention as a trend in your blog were done with Claude Code’s stealth mode and Mythos.
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#88Maybe it's marketing, but I think it's regrettable that Anthropic paired project Glasswing with Mythos. It really makes it seem like Mythos is the threat, rather than the fact that tons of vulnerabilities have always been ignored throughout the software world. If Glasswing has been started years ago with the goal of applying fixes to AI-found gaps, then this would just be another model to add to that effort. But doin…
I'm particularly interested if someone with relevant expertise could comment on the types of bugs Mythos found, e.g. the 27 year old OpenBSD bug. I ask because the media around Mythos is leaning into the "Mythos is a super intelligence that can find bugs that no human can" story. But in my mind it's pretty obvious that any software that is complex enough will have a lot of lurking zero days, and better tools will asy…
The OpenBSD bug was more difficult for LLMs, because it is an integer overflow bug, while out-of-bounds accesses are more common bugs that are found by most models.
The OpenBSD bug was also found by GPT-OSS and by Kimi-K2:
https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jag...
The first condition for finding a bug is to actually audit the code where bugs exist.
When a human does that, this is a lot of work, which is often avoided. LLMs can simplify this, but you must use them for this purpose.
As the link above shows, using multiple older open weights models was enough to find all the bugs found by Mythos.
The improvement demonstrated by Mythos is that it could be used alone to find all those bugs, while with older models you had to run more of them to find everything, because each model would find only a part of the bugs.
Even so, I prefer using all those open weights models together, at a negligible additional cost, while Mythos is unavailable for non-privileged users and even when it will be available for more people it will be much more expensive than the alternatives.
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#89Looks like the marketing worked at least somewhat lol. Such an obvious playbook by now I’m surprised some people here fell for it.
Your cynicism doesn't prove that it's fake, though.
You've got to admit that crying wolf about how dangerous their new model is for the hundredth time right when the biggest story about the company was a leak that made them and their internal vibe-coding look totally incompetent is a bit suspect.
Re: US summons bank bosses over cyber risks from Anthropic's latest AI model
#90Earlier quoted context omitted.
Your cynicism doesn't prove that it's fake, though.
You've got to admit that crying wolf about how dangerous their new model is for the hundredth time right when the biggest story about the company was a leak that made them and their internal vibe-coding look totally incompetent is a bit suspect.
Your cynicism doesn't prove that it's fake, though.