Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anthropic's open-source framework for AI-powered vulnerability discovery

github.com

Post reply on HN
Print view View original

151–160 of 177 posts

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#155

Post by tptacek »

froggit wrote: post #142
tptacek wrote: post #54

Earlier quoted context omitted.

What's destabilizing the industry right now isn't vulnerabilities AI introduces into new code; it's a flood of sev:hi vulnerabilities in existing code, not introduced by AI but discovered by it.

> What's destabilizing the industry right now isn't vulnerabilities AI introduces into new code; it's a flood of sev:hi vulnerabilities in existing code, not introduced by AI but discovered by it. Vulnerability discovery has essentially moved to a "proof of work" computation model with AI that has some similarities to crypto like BTC or ethereum 1.0. I don't see any reason a well funded adversary couldn't use this sa…

This doesn't make sense. Claude isn't creating the vulnerabilities. They've been here the whole time. You just get to know about them now.

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#156

Post by morpheos137 »

latentsea wrote: post #145
morpheos137 wrote: post #78

Earlier quoted context omitted.

kind of funny tokens don't prompt and steer themselves. it almost as if the value still lies with the human holding the tool.

They kinda do though, that's sort of how agents work. At least that's how it's always felt to me.

what is doing the steering is the weights of the words that came before in context. there is no agent or agency. if your problems need median effort and are well represented in shape in the corpus then agents may work well. true inovation is impossible without careful prompting, wherein the agent becomes an associative engine (kind of a smart search engine) and you the human become the manager of the process.

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#157

Post by XCSme »

nikcub wrote: post #7
simonw wrote: post #5

I wonder how much this thing costs to run. https://github.com/anthropics/defending-code-reference-harne... says: > As a rough guideline, expect ~10K uncached input tokens/min and ~2K output tokens/min per agent. You can scale parallelism up to your account's ITPM limit (roughly 10 agents per 100K ITPM). My guess would be hundreds of dollars with Opus and thousands of dollars with Mythos.

It's becoming apparent that it requires more tokens to secure code than it does to write it May even be an order of magnitude more

Not if the original code is secure...

Re: Anthropic's open-source framework for AI-powered vulnerability discovery

#158

Post by HarHarVeryFunny »

They seem to be using this to advertise their "Claude Security" product which promises to find vulnerabilities in your software.

This makes for a somewhat amusing set of product offerings given that according to Dario 90% of all software is being AI generated.

Maybe next they can sell something to find the bugs in the security scanner ?

Post reply on HN