I still find it funny that GPT-5.5 is just as good as Mythos and yet Anthropic likes to make things worse than they actually are.
What's your basis for this?
Expanding Project Glasswing
121–130 of 261 posts
Re: Expanding Project Glasswing
#122In the meantime, not everyone with actual access to the model are all that impressed.
Re: Expanding Project Glasswing
#123Here's my big fear: Even IF (and that's a BIG if) we get all critical vulnerabilities fixed in tech (before adversarial/state-actors turn up with open attack models) - we still have (in at least a year) models that will be so good in social engineering that they can still (given enough tokens) gain access to whatever system they want. If society can't trust banks and other institutions to safely control their data, w…
If things really get that bad then everything will require FIDO keys or push authorization using a phone app and possibly a initial registration code sent to a physical address. This is how Epic MyChart works.
Re: Expanding Project Glasswing
#124Is there any evidence Mythos is qualitatively better than the Opus 4.x? I'm afraid that the usual mantra that "we just need more scale" that worked well for attracting investments, is not working anymore - bigger models provide marginal improvements while naturally get much more expensive to run. Is this why both Anthropic and OpenAI are rushing for IPOs this year?
It is quantitatively better at finding and exploiting vulnerabilities. Pretty wild that everyone here is just in denial about that, when folks who have used it say it's as good as the hype
Cf wrote a genuinely good piece and had found a bunch of bugs: https://blog.cloudflare.com/cyber-frontier-models/
Wolfssl is security focused and it found a novel exploit https://www.wolfssl.com/how-claude-mythos-preview-helped-har...
You can pretend that it's all smoke and mirrors, but that just doesn't match up with reality: https://www.paloaltonetworks.com/blog/2026/05/defenders-guid...
Re: Expanding Project Glasswing
#125Re: Expanding Project Glasswing
#126I'll share the first-hand account I recently got from someone else.
> We've used it at work
> it is... not as hype as everyone is concerned about
> I'd argue the framework around it for security scanning is the arguably more useful side of the tool, definitely doesnt take a huge model to get all the issues it flagged on our systems
> For us, it absolutely flooded us with noise
> I mean hundreds if not thousands of false positives or minor issues or not applicable
> For every one reasonable issue
> The biggest issue it created was the execs treated every issue it produced like it was a drop everything and fix the issue type deal
> I'm talking company wide drop all things "we need to patch nginx because this module that no one uses and is disabled by default has this RCE vulnerability™
> Or "all ec2 AMIs need to be upgraded because it flagged a a version specific docker vulnerability", it flagged every single machine with docker regardless of if the actual vulnerability was relevant
> Vulnerability was with a very specific Auth plugin configuration you could enable with docker and specifically the Mosley docker compatible tool, but it is clear it only knew there was a vulnerability in docker, not if it was applicable or not
> Meanwhile dirtyfrag and friends not a single peep from btw despite it allowing for container escape
> Idk, I was underwhelmed with the quality of the reporting it gave really. If the company allowed me to get information about all the infrastructure in our entire organisation to run Claude over it repeatedly looking for recent CVEs I'm sure I could produce the same results...
Re: Expanding Project Glasswing
#127Here's my big fear: Even IF (and that's a BIG if) we get all critical vulnerabilities fixed in tech (before adversarial/state-actors turn up with open attack models) - we still have (in at least a year) models that will be so good in social engineering that they can still (given enough tokens) gain access to whatever system they want. If society can't trust banks and other institutions to safely control their data, w…
A lot of social engineering attacks die the second you have domain bound 2FA. Not everything, but a lot. But the idea that we'll squash all of the critical vulns is simply nonsense, despite the weird Firefox blog posts that indicate otherwise.
We don't need to squash all of them, we need to squash all of them that are practically findable by current and very near term frontier models.
Re: Expanding Project Glasswing
#128In the meantime, not everyone with actual access to the model are all that impressed. https://cyberplace.social/@GossiTheDog/116679693992983945
“Cybersecurity weather person and award winning shitposter.” why are they someone we should pay attention to the opinion of?
Re: Expanding Project Glasswing
#129Is this just one giant marketing plot?
Re: Expanding Project Glasswing
#130In case the topic of memory safety is interesting to anyone I've been experimenting with using AI agents to port common web infra projects to safe/ performant Rust. Somewhat inspired by the Bun port - was thinking that at some point memory safety might be such a big deal that people just need drop in replacements. - Valkey/ Redis port here https://github.com/ianm199/valdr (passes ~99% of single node test suite, real…
I find this kind of rewrite both disrespectful and completely useless. Useless because the difficulty isn't getting to a working state but maintaining it. You now have to build a community around it to make any of this worthwhile. What would this software be worth if security issues weren't patched and bugs weren't fixed? You can't do this alone.
And I find it disrespectful because people have spent decades building this, and you're taking all that collectively built knowledge to create something that will compete with the project itself.
I hope people will restrain themself from doing this at least in the name of good ethic. I fear this is going to hurt OSS a lot.
I hope people will hold back from this, if only out of respect for the work that came before. I fear it could do real damage to OSS. It would discourage the maintainers whose effort makes any of it possible.