Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: An Initial Update

anthropic.com

Post reply on HN
Print view View original

171–180 of 345 posts

Re: Project Glasswing: An Initial Update

#171

Post by solenoid0937 »

demorro wrote: post #86

If you're not already applying static analysis and linters to your codebase (and I know many of you aren't), ask yourself why you would bother to apply an expensive LLM tool? Not to say these things won't catch vulnerabilities static tools cannot, I think they can, it's just we already have the capability to automatically catch a large surface area of common vulns, and have chosen not to, often for expense reasons. I…

Static analysis won't develop a one click exploit that works end to end for you.

I'm at a FAANG and even our static analysis tools are not great at identifying how many issues are actually reachable.

Ideally you use both. An AI model that has static analysis as part of the harness, so it can evaluate each potential finding.

Re: Project Glasswing: An Initial Update

#172

Post by tptacek »

43ahg wrote: post #160
tptacek wrote: post #155

Earlier quoted context omitted.

It is definitely not the case that curl has been or is now a marquee vulnerability research target. It's a CLI HTTP fetcher. It's the same with sudo. It's a big deal if a sudo vulnerability gets found, because it's an extremely load-bearing piece of software, but sudo is itself not a prime target, because it doesn't do much.

There is no claim that it is a "vulnerability research target". It is a bug finding magnet, and bugs can be found by anything from gcc warnings to AI tools. No, it didn't attract a bluepill exploit research. The fact that 300 bugs found in a year is not a recommendation as the pro-AI mafia suddenly claims ("because it has been analyzed!") still stands. Maybe the AI-mafia should sell "analyzed by Mythos" labels to imp…

What’s a “bluepill exploit”?

Re: Project Glasswing: An Initial Update

#173

Post by scotty79 »

morpheos137 wrote: post #68
jimmar wrote: post #61

People predict that in 50 years, no human will be driving a car, and people will be shocked that we let humans drive cars manually. Coding may be the same. So many vulnerabilities in code written by very competent programmers. Manually building large, complex systems without major bugs or security vulnerabilities seems to be a nearly impossible challenge.

there is little evidence for this prediction.

What evidence would you expect to see if that was the case?

Re: Project Glasswing: An Initial Update

#174

Post by solenoid0937 »

gck1 wrote: post #163
skybrian wrote: post #131

Earlier quoted context omitted.

As the article explains, they mostly haven't been disclosed, because they're not fixed. They're giving people 90 days, or 45 after a patch is made.

> haven't been disclosed, because they're not fixed. That's convinient. But wait, don't they have this amazing AI that can fix all the issues itself with a single /goal command? What's the holdup?

You should really read the article, every question asked so far in this thread has been very clearly answered.

I miss the days when HN would RTFA.

Re: Project Glasswing: An Initial Update

#175

Post by nozzlegear »

mukmuk wrote: post #122

I’m not sure how to reconcile anthropic’s update / some of the exuberant comments here with recent feedback like the following from curl maintainer Daniel Steinberg: “I see no evidence that this setup [Mythos] finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to…

If I said what I think, dang would tell me to read the site's guidelines.

Re: Project Glasswing: An Initial Update

#176

Post by cassianoleal »

tomjakubowski wrote: post #130
mnahkies wrote: post #93

Earlier quoted context omitted.

One issue I've seen with LLM's is adding superfluous code in the name of "safety" and confidently generating a bunch of stuff that was useful in years gone by, but now handled correctly by the standard lib. I'm of the opinion that less is more when it comes to code, and find the trend this is introducing quite frustrating. How do you avoid this pitfall?

I wonder this too. I prompted Opus 4.7 to generate some Python threading code for me. The code to run the sub-thread looked like this: def run(): with contextlib.suppress(SystemExit): do_thread_thing() threading.Thread(target=run, daemon=True).start() Suppressing SystemExit was surprising, and made me curious. I followed up and asked the model: what's the purpose of that? The model's response: "Honestly? Cargo-cultin…

I had some shell scripts littered with `|| true`, which was obviously obscuring real errors everywhere. When I challenged the model, it gave me the same "cargo-culting" answer.

Re: Project Glasswing: An Initial Update

#178

Post by solenoid0937 »

ZrArm wrote: post #114

> After one month, most partners have each found hundreds of critical- or high-severity vulnerabilities in their software. And at the moment we have reports from like around 5(?) companies. Btw, Palo Alto Networks has found only 26 vulnerabilities [1]. I'm interested what those partners are and why they have such big amount of vulnerabilities. > For instance, Cloudflare has found 2,000 bugs (400 of which are high- or…

> And at the moment we have reports from like around 5(?) companies.

Which is not bad this early in the 90+45 day responsible disclosure window.

> Yet decided not to share that number. I wonder why.

It is bizarre to expect a company to disclose the false-positive rate of their security engineers, publicly. That does not happen.

> So, ~6 high- and critical- severity bugs per open-source project v.s. hundreds of high- and critical- severity bugs per partner projects. It looks like the math ain't mathing.

It is pretty obvious they're spending more compute on commercial partners. Why is this surprising?

> Of course, they didn't say that Mythos found only 8 bugs in wolfSSL vs 22 CVE fixed in wolfSSL 5.9.1.

WolfSSL is not the only software project in the world. Mozilla also came out with results that paint it as very effective. I don't think Mythos ever claimed to find all bugs anyways.

Re: Project Glasswing: An Initial Update

#179

Post by nozzlegear »

solenoid0937 wrote: post #171
demorro wrote: post #86

If you're not already applying static analysis and linters to your codebase (and I know many of you aren't), ask yourself why you would bother to apply an expensive LLM tool? Not to say these things won't catch vulnerabilities static tools cannot, I think they can, it's just we already have the capability to automatically catch a large surface area of common vulns, and have chosen not to, often for expense reasons. I…

Static analysis won't develop a one click exploit that works end to end for you. I'm at a FAANG and even our static analysis tools are not great at identifying how many issues are actually reachable. Ideally you use both. An AI model that has static analysis as part of the harness, so it can evaluate each potential finding.

> Ideally you use both. An AI model that has static analysis as part of the harness, so it can evaluate each potential finding.

Ideally the static analysis tools are improved so that we don't need to piss away yet more tokens like we're competing on Mark's leaderboard just to find vulnerabilities.

Re: Project Glasswing: An Initial Update

#180

Post by solenoid0937 »

nozzlegear wrote: post #179
solenoid0937 wrote: post #171

Earlier quoted context omitted.

Static analysis won't develop a one click exploit that works end to end for you. I'm at a FAANG and even our static analysis tools are not great at identifying how many issues are actually reachable. Ideally you use both. An AI model that has static analysis as part of the harness, so it can evaluate each potential finding.

> Ideally you use both. An AI model that has static analysis as part of the harness, so it can evaluate each potential finding. Ideally the static analysis tools are improved so that we don't need to piss away yet more tokens like we're competing on Mark's leaderboard just to find vulnerabilities.

When you reach that ideal world, let me know. My company has thrown a decade+ and multiple teams at the idea you've described. We still aren't there yet.

Your proposal of relying purely on static analysis is over-idealistic and just not feasible for large, diverse codebases in the real world.

That's where AI comes in.

Post reply on HN