I still find it so weird that they haven't bought out whoever controls the `anthropic` github username.
Anthropic's open-source framework for AI-powered vulnerability discovery
51–60 of 177 posts
Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#52> Anthropic engineers on average ship 8x as much code per quarter Are they making 8x more features or the same amount just with more code?
Going by the issues on their repos, it's 2x features and 6x regressions of bugs that were "already fixed".
Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#53I wonder how much this thing costs to run. https://github.com/anthropics/defending-code-reference-harne... says: > As a rough guideline, expect ~10K uncached input tokens/min and ~2K output tokens/min per agent. You can scale parallelism up to your account's ITPM limit (roughly 10 agents per 100K ITPM). My guess would be hundreds of dollars with Opus and thousands of dollars with Mythos.
It's becoming apparent that it requires more tokens to secure code than it does to write it May even be an order of magnitude more
Given the slop that's made its way to Github we can see that this is a great profit model. Ship slop and then "fix" slop. What an efficient use of our planet!
Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#54Earlier quoted context omitted.
It's becoming apparent that it requires more tokens to secure code than it does to write it May even be an order of magnitude more
It's weird because why can't they train the AI to simply output secure code? The basic security flaws with regards to input validation and overflows should never ever be output by an AI. For "security flaws due to bad design" I'll cut them slack until AGI is achieved.
What's destabilizing the industry right now isn't vulnerabilities AI introduces into new code; it's a flood of sev:hi vulnerabilities in existing code, not introduced by AI but discovered by it.
Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#55Sligthly off topic: it seems that someone is in a dead/flag rampage killing all good links to Github in this post, why?
Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#56Very interesting.
I have working on and using a similar tool for a while now :
https://github.com/bobinson/vulture
I have been struggling with false positives and using Claude + MCP as a poor man’s audit tool. As of last few days found better result with nvidia hosted models.
Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#57Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#58Earlier quoted context omitted.
It's becoming apparent that it requires more tokens to secure code than it does to write it May even be an order of magnitude more
It's weird because why can't they train the AI to simply output secure code? The basic security flaws with regards to input validation and overflows should never ever be output by an AI. For "security flaws due to bad design" I'll cut them slack until AGI is achieved.
I think these audit tools can look beyond just security and can look for compliance audits as well. The ability to audit real targets in staging environments makes it easy to identify issues.
Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#59The thing about things like this is that they're shop jigs. You can buy a crosscut sled if you really want to, but most woodworkers just make their own. It was a different situation 2 years ago, when there was significant cost to building your own harness (but then: you probably weren't doing AI vuln research 2 years ago). Today, I think your best bet is to look at something like this for ideas, and then just ask for…
"Shop jigs" is a great way to put it. I think a lot of software has gone from being made for general use to extremely individualised use. Before the Age of AI, it took so much human effort to write something that solved your problem that you might often go the extra mile so that others could re-use it. Now, it takes almost no effort, so the software stays ungeneralised. Some of the incentive has changed, I think. Mos…
That’s an interesting way to say “code quality in the age of ai has gone out the window”
Re: Anthropic's open-source framework for AI-powered vulnerability discovery
#60I wonder how much this thing costs to run. https://github.com/anthropics/defending-code-reference-harne... says: > As a rough guideline, expect ~10K uncached input tokens/min and ~2K output tokens/min per agent. You can scale parallelism up to your account's ITPM limit (roughly 10 agents per 100K ITPM). My guess would be hundreds of dollars with Opus and thousands of dollars with Mythos.
If you compare to their managed service, that estimate is likely 1/10th expectation, depending on codebase.
But even this larger number, in turn, can be about 1/10th the cost of a formal engagement to discover the type of findings it seems to be going for: things that do not show up from PR reviews or even /security-review without the pre-work steps in the open-source framework guided by an expert. That's not counting the time and delay to figure out how to do that engagement.
Bluntly: if it matters, while this is a month's vibing budget for a single scan, it is also "pennies on the dollar" dirt cheap.
At the same time, its findings still need an expert. Its suggestions may be helpful, they may be actively harmful, depends on the prework quality.
Recommendation to IT department heads: spend a couple grand on this, use the scare page to rustle up the budget to build a relationship with a red team that can find, triage, help remediate if needed, and train your in-house team to be "security minded".