Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anthropic's open-source framework for AI-powered vulnerability discovery

github.com

Post reply on HN
Print view View original

41–50 of 177 posts

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#41

Post by ryancw »

zuzululu wrote: post #36
tptacek wrote: post #18

The thing about things like this is that they're shop jigs. You can buy a crosscut sled if you really want to, but most woodworkers just make their own. It was a different situation 2 years ago, when there was significant cost to building your own harness (but then: you probably weren't doing AI vuln research 2 years ago). Today, I think your best bet is to look at something like this for ideas, and then just ask for…

[flagged]

As a woodworker, it’s a really nice analogy and beyond anything I’ve seen AI do.

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#42

Post by skeledrew »

Hamuko wrote: post #26
lanyard-textile wrote: post #2

>This repo is not maintained and is not accepting contributions. Hm :)

Why isn't Claude maintaining it?

They pretty much saying the efficacy of the tool can be tested by anyone to determine if it's worth purchasing the more polished and up-to-date commercial offering.

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#45

Post by [deleted] »

zuzululu wrote: post #36
tptacek wrote: post #18

The thing about things like this is that they're shop jigs. You can buy a crosscut sled if you really want to, but most woodworkers just make their own. It was a different situation 2 years ago, when there was significant cost to building your own harness (but then: you probably weren't doing AI vuln research 2 years ago). Today, I think your best bet is to look at something like this for ideas, and then just ask for…

[flagged]

[deleted]

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#46

Post by redfloatplane »

tptacek wrote: post #18

The thing about things like this is that they're shop jigs. You can buy a crosscut sled if you really want to, but most woodworkers just make their own. It was a different situation 2 years ago, when there was significant cost to building your own harness (but then: you probably weren't doing AI vuln research 2 years ago). Today, I think your best bet is to look at something like this for ideas, and then just ask for…

"Shop jigs" is a great way to put it. I think a lot of software has gone from being made for general use to extremely individualised use. Before the Age of AI, it took so much human effort to write something that solved your problem that you might often go the extra mile so that others could re-use it. Now, it takes almost no effort, so the software stays ungeneralised. Some of the incentive has changed, I think. Most of the time I no longer share the things I've been building[0] because, for one thing they simply couldn't possibly have any benefit for others, and if they need something like it, they can build exactly the thing they want instead of having to extend or modify my thing. Like a jig!

0: https://redfloatplane.lol/blog/17-why-share/ (and related posts, I guess)

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#47

Post by rms2ds »

bigmattystyles wrote: post #4

I wonder how this sort of product is going over at Coverity and others like it. Proper SAST vendors I mean. Is it an existential threat?

If I had to guess, they'l eventually just add it into their own product and hike the prices up to cover tokens lol.

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#49

Post by binyu »

simonw wrote: post #5

I wonder how much this thing costs to run. https://github.com/anthropics/defending-code-reference-harne... says: > As a rough guideline, expect ~10K uncached input tokens/min and ~2K output tokens/min per agent. You can scale parallelism up to your account's ITPM limit (roughly 10 agents per 100K ITPM). My guess would be hundreds of dollars with Opus and thousands of dollars with Mythos.

Claude workflows in ultra code mode works in a very similar fashion and it consumes a moderate amount of the session usage limit, depending on the complexity of the task. With the API it would probably get expensive quickly though

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#50

Post by thisogood »

tptacek wrote: post #19
nikcub wrote: post #7

Earlier quoted context omitted.

It's becoming apparent that it requires more tokens to secure code than it does to write it May even be an order of magnitude more

For now, maybe, yes? But the most important targets of this kind of work aren't AI outputs; it's legacy code, particularly (but not exclusively) old memory-unsafe code. In those situations the figure of merit isn't the token cost of recreating the target code; it's the cost of finding the same bugs with humans or preexisting tools. Those costs can be extremely high.

[dead]
Post reply on HN