Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: An Initial Update

anthropic.com

Post reply on HN
Print view View original

121–130 of 345 posts

Re: Project Glasswing: An Initial Update

#121

Post by ZrArm »

OsrsNeedsf2P wrote: post #11
pertymcpert wrote: post #6

Earlier quoted context omitted.

> Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview—over ten times more than they found in Firefox 148 with Claude Opus 4.6 4.6 but close.

Right, but were they using the same methodology and harness? I'm skeptical that they're doing something with the harness - i.e. with Mythos, they pass each file in one at a time, whereas on 4.6 they let Claude Code run loose to find bugs. This would have a larger impact difference than the model itself.

From Mozilla post [1]:

"...After fixing the initial set of issues that Anthropic sent to us in February, we built our own harness atop our existing fuzzing infrastructure.

We began with small-scale experiments prompting the harness to look for sandbox escapes with Claude Opus 4.6. Even with this model, we identified an impressive amount of previously-unknown vulnerabilities which required complex reasoning over multiprocess browser engine code..."

So yeah, Anthropic and Mozilla likely compare "Amount of bugs found by Opus 4.6 during early experiments" vs "Amount of bugs found by Mythos during large-scale codebase scanning".

[1] https://hacks.mozilla.org/2026/05/behind-the-scenes-hardenin...

Re: Project Glasswing: An Initial Update

#122

Post by mukmuk »

I’m not sure how to reconcile anthropic’s update / some of the exuberant comments here with recent feedback like the following from curl maintainer Daniel Steinberg:

“I see no evidence that this setup [Mythos] finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.”

https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-v...

Re: Project Glasswing: An Initial Update

#123

Post by Oarch »

jimmar wrote: post #61

People predict that in 50 years, no human will be driving a car, and people will be shocked that we let humans drive cars manually. Coding may be the same. So many vulnerabilities in code written by very competent programmers. Manually building large, complex systems without major bugs or security vulnerabilities seems to be a nearly impossible challenge.

I reckon that in 50 years the very idea of code existing will be esoteric knowledge, a bit like binary. We simply won't care to think at that level of abstraction anymore.

Re: Project Glasswing: An Initial Update

#124

Post by NitpickLawyer »

casey2 wrote: post #115
NitpickLawyer wrote: post #109

Earlier quoted context omitted.

Writing marketing 10 times doesn't invalidate the (many) claims from many respectable sources that the model is a step change in cybersec. There's also the report [1] from the Brits that track cyber capabilities since '22 or '23 and they've also confirmed it's a step change (together with 5.5 cyber or whatever they call it). Marketing is like propaganda. It doesn't need to be based on false facts. Of course they're g…

Please don't misrepresent the article it says clearly "a step up in cyber performance over previous frontier models" and that gpt-5.5 is on their tests is slightly better than mythos.

Scroll to the graph labeled "Completed steps..."

If that doesn't convince you that both mythos and 5.5 are a step up (several steps, hah) nothing will.

Re: Project Glasswing: An Initial Update

#125

Post by darkamaul »

Amekedl wrote: post #106

I don't buy it. A lot of stuff this finds is also just simply wrong, benignly reported as true, despite upper/lower layers in the code burying the possibility of a vulnerability actually being exploited. It's a performance/security trade-off too, it always has been. Additional checks and other measures do in fact need to be performed for security purposes. Great marketing as always, but the rose-tinted view many have…

I guess you could look at https://red.anthropic.com/2026/cvd/ to see exactly what was discovered.

Re: Project Glasswing: An Initial Update

#126

Post by gck1 »

solenoid0937 wrote: post #112
gck1 wrote: post #100

Earlier quoted context omitted.

> This is why I believe mythos will remain private for the foreseeable future. There's such a large surface that needs to be secured and so much to triage, fix, deploy. sigh I remember the GPT-2 days - when it was the first time OpenAI restricted access to the models citing "humanity is not ready for it". The model was good at writing poetry or something. Since then, I don't remember a single model announcement from…

I think you just aren't reading the post, or any of the Glasswing partner's posts. You have this view in your head of what Mythos is, and nobody can say anything dissuade you from it.

"Partners" is the important word in your comment. I am reading all of it, but I have a huge barrel of salt to consume along with everything that I read, because I see conflicts of interest everywhere I go, with fancy words and no means to verify.

If I was given free access to any frontier model to use on my projects, equivalent of millions of dollars in AI credits, I sure hope people didn't trust anything that came out of my mouth until they were able to verify my claims themselves.

AI industry has even resulted in a new term - benchmaxing - which essentially means we can't even trust the data anymore until we can touch the model ourselves. So this is not at all surprising to me. What's surprising is why am I in the minority here, and since when trusting authorities that have obvious conflicts of interest became normal.

Re: Project Glasswing: An Initial Update

#127

Post by Amekedl »

darkamaul wrote: post #125
Amekedl wrote: post #106

I don't buy it. A lot of stuff this finds is also just simply wrong, benignly reported as true, despite upper/lower layers in the code burying the possibility of a vulnerability actually being exploited. It's a performance/security trade-off too, it always has been. Additional checks and other measures do in fact need to be performed for security purposes. Great marketing as always, but the rose-tinted view many have…

I guess you could look at https://red.anthropic.com/2026/cvd/ to see exactly what was discovered.

Thank you. Looking at the WebDAV in nginx, this is exactly what I searched for, wanted to read, and confirmed my suspicions ^^ But this one takes the cake truly... https://red.anthropic.com/2026/cvd/findings/ANT-2026-CN7KX43...

Re: Project Glasswing: An Initial Update

#129

Post by skybrian »

mukmuk wrote: post #122

I’m not sure how to reconcile anthropic’s update / some of the exuberant comments here with recent feedback like the following from curl maintainer Daniel Steinberg: “I see no evidence that this setup [Mythos] finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to…

Different people can have different experiences without contradiction. Maybe the curl source code was pretty clean to begin with?

Re: Project Glasswing: An Initial Update

#130

Post by tomjakubowski »

mnahkies wrote: post #93
mdeeks wrote: post #34

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the "Low" findings…

One issue I've seen with LLM's is adding superfluous code in the name of "safety" and confidently generating a bunch of stuff that was useful in years gone by, but now handled correctly by the standard lib. I'm of the opinion that less is more when it comes to code, and find the trend this is introducing quite frustrating. How do you avoid this pitfall?

I wonder this too. I prompted Opus 4.7 to generate some Python threading code for me. The code to run the sub-thread looked like this:

    def run():
        with contextlib.suppress(SystemExit):
            do_thread_thing()

    threading.Thread(target=run, daemon=True).start()
Suppressing SystemExit was surprising, and made me curious. I followed up and asked the model: what's the purpose of that?

The model's response: "Honestly? Cargo-culting on my part. You should remove it."

Post reply on HN