Live data from Hacker News

Project Glasswing: what Mythos showed us

blog.cloudflare.com

121–130 of 152 posts

Re: Project Glasswing: what Mythos showed us

#121
post #53

Earlier quoted context omitted.

But why would cloudflare advertise Anthropic? They are competing with Anthropic by hosting open weights models.

https://www.cloudflare.com/press/press-releases/2025/cloudfl...

Can you elaborate? That just seems to be a Cloudflare's announcement from May 2025 that they'd be supporting MCP servers.

Re: Project Glasswing: what Mythos showed us

#122

'Narrow scope produces better findings - Telling the model "Find vulnerabilities in this repository" makes it wander. Telling it "Look for command injection in this specific function, with this trust boundary above it, here's the architecture document and here's prior coverage of this area" makes it do something much closer to what a researcher would actually do.' So what, we take every function and every vulnerabili…

This matches with what Nicholas Carlini from Anthropic said a the [un]prompted conference - https://www.youtube.com/watch?v=1sd26pWhfmg. Very worth watching.

Re: Project Glasswing: what Mythos showed us

#123

'Narrow scope produces better findings - Telling the model "Find vulnerabilities in this repository" makes it wander. Telling it "Look for command injection in this specific function, with this trust boundary above it, here's the architecture document and here's prior coverage of this area" makes it do something much closer to what a researcher would actually do.' So what, we take every function and every vulnerabili…

Who is him?

Raised an eyebrow for me too. It’s interesting to see people subconsciously (?) assign a gender (him/her) to LLMs rather than using the appropriate “it.”

Re: Project Glasswing: what Mythos showed us

#125
post #94
post #47

Earlier quoted context omitted.

yeah? it’s not that weird of a term

It’s weird when someone starts using terminology that is heavily over-indexed by LLMs out of the blue.

Huh, I've heard this term all the time at work and used it myself since long before LLMs

Re: Project Glasswing: what Mythos showed us

#126
post #38

Earlier quoted context omitted.

I had a dude in a conversation non-ironically use "load-bearing." I could only follow up with, "that is a genuine insight." Not a single person visibly flinched in pain.

Let's double-click on that. It's important to keep top of mind that using disruptive words and patterns in conversation isn't always driven by LLMs — reasoning from first principles tells us that problematic usages like this existed beforehand. One of my load-bearing career learnings is that people used this shape of language as a shibboleth long before game-changing tools like ChatGPT started slopping so much of wha…

I don't think it's performative or about vibes. Everyone subconsciously adopts phrases and in general ways of talking from people around them. May it be from friends, neighbors or coworkers.

Re: Project Glasswing: what Mythos showed us

#127
>Why pointing a generic coding agent at a repo doesn't work

The author of this blog post does not acknowledge the existence of subagents and thinks that it's not possible for a model to come up with multiple ideas and have multiple streams of thought at the same time.

Re: Project Glasswing: what Mythos showed us

#128

'Narrow scope produces better findings - Telling the model "Find vulnerabilities in this repository" makes it wander. Telling it "Look for command injection in this specific function, with this trust boundary above it, here's the architecture document and here's prior coverage of this area" makes it do something much closer to what a researcher would actually do.' So what, we take every function and every vulnerabili…

> So what, we take every function and every vulnerability type and just run the agents millions of times?

Yes.

We build a skill where a coordinator AI enumerates all possible vulnerability types and all functions, then launches parallel max effort Mythos agents against all vulnerability x function pairs.

I've been doing something like this with Opus already. General code review. Enumerated dimensions like correctness, security, maintainability, etc. Asked the coordinator AI to explore the code and autodiscover subsystem boundaries. Then it runs an absurd amount of dimension x subsystem review agents.

It burns a lot of tokens and takes me like three days to complete a review session, but the results have been excellent so far. The resulting TODO list will keep me occupied for quite a while.

I can only imagine what these corporations with unlimited money are doing. Poor me can't afford API prices so I had to not only limit scope but also design a filesystem-like journaling mechanism for the agents in order to deal with the rate limit interruptions. I'm sure Cloudflare is not gonna have that problem.

Re: Project Glasswing: what Mythos showed us

#129
post #94

Earlier quoted context omitted.

It’s weird when someone starts using terminology that is heavily over-indexed by LLMs out of the blue.

Huh, I've heard this term all the time at work and used it myself since long before LLMs

Same

Re: Project Glasswing: what Mythos showed us

#130
> They ingest a lot of source code, hold a single hypothesis at a time, and iterate against it. That's exactly the wrong shape for vulnerability research, which is narrow and parallel by nature

LLMs are trained on Ed Sheeran lyrics

Post reply on HN