Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: An Initial Update

anthropic.com

Post reply on HN
Print view View original

71–80 of 345 posts

Re: Project Glasswing: An Initial Update

#71

Post by mixologic »

Right now the only codebase I care about them fixing vulnerabilities in are the 3800 repositories that got stolen from GitHub.

"Vulnerabilities in the software that makes the internet" is honestly lower priority than "The platform that the software that makes the internet uses to make releases" If buyers of those internal repos find ways to break into GitHub such that they can cut software releases, or poison github actions from a distance, then we're all in a very ugly mess.

Don't forget that in those 3800 repos is likely also npmjs.org itself.

Re: Project Glasswing: An Initial Update

#72

Post by raincole »

winstonwinston wrote: post #54
mdeeks wrote: post #34

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the "Low" findings…

> I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. So, how is that supposed to work? Claude Code generates security bugs, then Claude Security finds them, then Claude Code generate fix, spend tokens, profit?

Humans work like that too. If you're not comfortable with Claude involves in every step (for whatever reason) then just use different providers for each.

Re: Project Glasswing: An Initial Update

#73

Post by mpyne »

OsrsNeedsf2P wrote: post #11
pertymcpert wrote: post #6

Earlier quoted context omitted.

> Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview—over ten times more than they found in Firefox 148 with Claude Opus 4.6 4.6 but close.

Right, but were they using the same methodology and harness? I'm skeptical that they're doing something with the harness - i.e. with Mythos, they pass each file in one at a time, whereas on 4.6 they let Claude Code run loose to find bugs. This would have a larger impact difference than the model itself.

Yes, the harness they used actually existed and was in use beforehand, it wasn't developed for testing with Mythos.

Re: Project Glasswing: An Initial Update

#74

Post by cubefox »

morpheos137 wrote: post #68
jimmar wrote: post #61

People predict that in 50 years, no human will be driving a car, and people will be shocked that we let humans drive cars manually. Coding may be the same. So many vulnerabilities in code written by very competent programmers. Manually building large, complex systems without major bugs or security vulnerabilities seems to be a nearly impossible challenge.

there is little evidence for this prediction.

The rapid progress in the last few years in this regard is pretty strong evidence in my opinion.

Re: Project Glasswing: An Initial Update

#75

Post by cheesefck »

jimmar wrote: post #61

People predict that in 50 years, no human will be driving a car, and people will be shocked that we let humans drive cars manually. Coding may be the same. So many vulnerabilities in code written by very competent programmers. Manually building large, complex systems without major bugs or security vulnerabilities seems to be a nearly impossible challenge.

Musk has been predicting self driving cars next year for fifteen years. Fifty years ago, everyone was going to be flying supersonic all the time. Flying cars were just around the corner. Interplanetary travel. Everyone forgets the technology that fails.

This is the MoviePass era of language models

Re: Project Glasswing: An Initial Update

#78

Post by ayeeeeeeeeee »

It would be informative to publish not only vulnerability numbers, but also vulnerability type statistics (as available here for example: https://cvedb.github.io/years.html), such that programmers can understand which types of exploits popular systems and languages commonly allow, and thereby encourage fundamental changes to fix or transition away from them.

Re: Project Glasswing: An Initial Update

#79

Post by 0gs »

wiwiwq wrote: post #16
rhubarbtree wrote: post #14

Earlier quoted context omitted.

IPO is coming is what is going on

That’s implicit in my post. If people actually believe the narrative then the bankers will over price Anthropic and get away with it.

what's weirdest to me (and i agree with you) is that it could ALSO be true that a highly competently managed, highly capitalized closed source and weights model training on tons of real-world data non-stop COULD stay ahead of open weights models, and that lead COULD grow. now, how competent (much less merciless) the frontier-blazing U.S. corporations will be able to be long-term ... i suspect they are right to be nervous and highly focused on optics, regardless of the truth :)
Post reply on HN