Live data from Hacker News

All the bugs they found

andreapivetta.com

21–30 of 39 posts

Re: All the bugs they found

#21

> Trying to work around Anthropic blocking security-related prompts does get pretty tiring though. Didn't know this is a thing... interesting for a company that's marketing their Mythos so hard not allowing security prompts. I am also curious how the cheaper Chinese models do, I have an Opencode Go plan, so I'll let 'em rip over the weekend, hopefully I get to see a few bugs!

I think that's consistent of Anthropic.

The whole point of Mythos/Glasswing is "our best models are scary good at security research, so much so that we won't let them help you find vulnerabilities unless you are a trusted partner".

Re: All the bugs they found

#22
post #15

He describes himself as "Software engineer. Writing code prompts at Google". So throwing his own, apparently poorly written, creation under the bus will get him applause and promotions by the AI lunatics. It is a currently popular strategy among AI boosters.

I can't speak to the larger trend of AI boosters, as I don't go out of my way to pay attention to them, but the practice of being vocally self-critical and openly discussing the flaws found in one's own software (whether from AI or human analysts) is a damn good idea for reasons that can best be understood by rehashing the vulnerability disclosure debate in one's own mind.

Re: All the bugs they found

#23
post #20
post #15

He describes himself as "Software engineer. Writing code prompts at Google". So throwing his own, apparently poorly written, creation under the bus will get him applause and promotions by the AI lunatics. It is a currently popular strategy among AI boosters.

What a weird comment. You think he cynically decided to boost his career by writing a detailed description of the exploits found in his own software. Is there no room in your model of the world for someone to figure out something interesting using AI tools and then write about it just because they like sharing interesting information?

It is not at all, in the slightest, weird heuristic to deploy in the Agentic Era.

It’s a heuristic after all. There is no proof one way or the other.

Re: All the bugs they found

#24
post #15

He describes himself as "Software engineer. Writing code prompts at Google". So throwing his own, apparently poorly written, creation under the bus will get him applause and promotions by the AI lunatics. It is a currently popular strategy among AI boosters.

Honestly your poor assessment is in all ways poorer than his poorly written creation.

Did you even have 2-3 minutes to click around his website and gave a read to his other article "Something that I used to love"?

Your type of disparaging comments give the impression of HN to others what HN totally isn't. I don't know if you wrote your comment esp. for engagement baiting.

Re: All the bugs they found

#25
post #21

> Trying to work around Anthropic blocking security-related prompts does get pretty tiring though. Didn't know this is a thing... interesting for a company that's marketing their Mythos so hard not allowing security prompts. I am also curious how the cheaper Chinese models do, I have an Opencode Go plan, so I'll let 'em rip over the weekend, hopefully I get to see a few bugs!

I think that's consistent of Anthropic. The whole point of Mythos/Glasswing is "our best models are scary good at security research, so much so that we won't let them help you find vulnerabilities unless you are a trusted partner".

You can just fill out a form and be in their security researcher program, which dials back the refusals.

Re: All the bugs they found

#26
post #20
post #15

He describes himself as "Software engineer. Writing code prompts at Google". So throwing his own, apparently poorly written, creation under the bus will get him applause and promotions by the AI lunatics. It is a currently popular strategy among AI boosters.

What a weird comment. You think he cynically decided to boost his career by writing a detailed description of the exploits found in his own software. Is there no room in your model of the world for someone to figure out something interesting using AI tools and then write about it just because they like sharing interesting information?

The irritating thing about this thread is that it's a human-authored post about vulnerabilities in a WASM interpreter, which isn't a common genre --- it's interesting on its own terms. But as usual, instead of discussing the interesting thing, we're rehashing the high-salience culture war issue instead.

Re: All the bugs they found

#28

The cool thing about LLMs is that once a capability is "good enough" you can always "chain" them together for better overall results. On the client side this means "write an API that does x y z" -> "analyse this API for security concerns" -> "PoC for each finding from this report" -> "fix this code according to these verified claims". On the "server side" (i.e. training) you can use the current gen models to improve…

The bad thing about software is that there's infinite ways to solve the same problem, and the vast majority of them are terrible and unmaintainable, so "working" is a prerequisite, but not really "good enough".

It's good if no LLMs can find a bug. It certainly does not mean there isn't one...

I've found LLMs to be very disappointing at identifying overly complex code (that they've written) and the correct architectural decisions to 1) make the code actually work, and 2) be simple, maintainable, and future proof.

They can certainly find some bugs, which definitely has value, but I've not had much success with them writing code that simply has no bugs...

That requires simplicity and architectural correctness, something LLMs are good at vaguely bullshitting, but not very good at getting correct.

I think this can be solved by feeding them the right metrics, but I haven't found prior art for how to algorithmically pinpoint: 1) what is actually complex in a bad way (there's a lot of ways to do this roughly), and 2) where exactly the problem is most acutely (less prior art here, but some), and 3) what viable solutions are.

If you can get better at 1 and 2, the LLMs can get much better at 3.

Anybody who has ideas, I'd love to hear them, as this is what I'm working on now.

Post reply on HN