Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mythos Finds a Curl Vulnerability

daniel.haxx.se

Post reply on HN
Print view View original

211–220 of 298 posts

Re: Mythos Finds a Curl Vulnerability

#211

Post by skybrian »

matltc wrote: post #185
yjftsjthsd-h wrote: post #7

> Not particularly “dangerous” I'm not sure that follows. As noted, curl was already analyzed to death with every tool available; most software isn't at that level.

Mythos is either dangerous or not. We are taking dangerous to mean that the number of vulns it finds will be much greater than bugs found with available tools. Since mythos found only one additional vuln, and since x+1 is not much greater than x, it follows that mythos is not dangerous per the definition above.

It doesn’t follow because the results for curl don’t necessarily generalize to other codebases. It’s evidence against Mythos being particularly dangerous, but it’s just one datapoint.

It doesn’t invalidate the other security bugs Mythos allegedly found in other codebases.

Re: Mythos Finds a Curl Vulnerability

#212

Post by toraway »

h1fra wrote: post #37
rzmmm wrote: post #3

Quote: "My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in co…

They might be biased by the fact that curl is significantly more secure than the average software

I've seen this suggested a few times in this thread but it seems like it's exactly backwards.

Wouldn't that make it a better to distinguish whether Mythos is uniquely super powerful vs an incremental improvement from Opus etc that are routinely used as the basis for bug reports/fixes in cURL?

If Mythos found a hundred new show stopper bugs then it would have meant Opus missed them and therefore closer to a "step change". Otherwise it implies the difference in capability isn't nearly that stark. Mythos finding 100 low-hanging bugs in a less scrutinized/hardened project on the wouldn't be as useful signal to answer that.

Re: Mythos Finds a Curl Vulnerability

#213

Post by addedGone »

u_fucking_dork wrote: post #206
NitpickLawyer wrote: post #121

What's going on in this thread? It's weird how prevalent the negativity towards mythos is, and I'm not sure if it's people throwing the baby out with the bathwater or something more tinfoil-adjacent coordinated campaign. I also noticed this on a thread a few days ago, before the mozilla post. There were dozens of comments saying basically "mythos is vaporware". I get the idea that they're using it for marketing. Of c…

> And then there's the team at mozilla And then there’s the team at curl. Don’t fall for the cheap marketing stuff just because you like them Everything points to Mythos being marginally better and nobody being able to afford to run it.

Many can afford it, many companies are easily spending 15-30K a month in tokens per staff.

Re: Mythos Finds a Curl Vulnerability

#214

Post by toraway »

sporkland wrote: post #199
wongarsu wrote: post #197

Earlier quoted context omitted.

There are three things happening simultaneously: 1st a new model, codenamed "Mythos", 2nd a lightweight harness built for finding vulnerabilities, and 3rd a push by Anthropic to collaborate with various Open Source projects and companies to use 1 and 2 to find vulnerabilities We know that the combination of all three results in finding lots of security vulnerabilities. That's what Mozilla is talking about. The quote…

Not to discredit anything that was said in any particular blog post. Folks also need to remember that a lot of blog posts are written by engineers or managers that have their own agendas and careers and often external blog posts can be a form of self marketing or idea marketing that an engineer or director has been pushing internally. I have no idea if this happened in mozilla's case but the person that wrote it seem…

Also, the people at Mozilla who helped achieve a highly visible collaboration with the hottest AI company in the zeitgeist that included a lot of expensive data center time to harden their flagship product are definitely going to be happy/excited/proud about pulling it off successfully.

There's a lot of kneejerk "so you're accusing Mozilla of a conspiracy to boost Anthropic?" which is an overly simplistic lens. Particularly when it involves groups of individual humans with different motivations and emotional investment in their own contributions to the collaboration.

Re: Mythos Finds a Curl Vulnerability

#215

Post by slipnslider »

johnbarron wrote: post #59
therealpygon wrote: post #51

Earlier quoted context omitted.

Anthropic using marketing to convince people their models are more advanced, better built, or that AI is a threat that needs to be regulated because only they have the answer? I’m shocked. More seriously, so far I haven’t seen much indication that Mythos is more than Opus with a security focused code analysis harness. That said, the fact it can find these bugs in an automated fashion is the more important takeaway ou…

>> Anthropic using marketing to convince people their models are more advanced, better built, or that AI is a threat that needs to be regulated because only they have the answer? I’m shocked. I remember when OpenAI was saying GPT-2 was too dangerous to release.

And Anthropic was founded by former, high ranking OpenAI employees so they were accustomed to the classic "its so dangerous we can't release it" trope.

It sounds like Mythos is good but none of us know exactly how good since they haven't released it yet. It also sounds like Anthropic is compute starved which is probably the biggest reason it has had a public release

Re: Mythos Finds a Curl Vulnerability

#216

Post by doctorpangloss »

NitpickLawyer wrote: post #121

What's going on in this thread? It's weird how prevalent the negativity towards mythos is, and I'm not sure if it's people throwing the baby out with the bathwater or something more tinfoil-adjacent coordinated campaign. I also noticed this on a thread a few days ago, before the mozilla post. There were dozens of comments saying basically "mythos is vaporware". I get the idea that they're using it for marketing. Of c…

HN readers really like the idea of Daniel, he's sticking it to the man... by doing free publicity and work for the man haha

Re: Mythos Finds a Curl Vulnerability

#217

Post by JeremyNT »

embedding-shape wrote: post #115
JeremyNT wrote: post #103

Earlier quoted context omitted.

This is roughly what I was assuming but of course the big caveat here is that they were already using the existing LLM driven tooling on an extensively audited codebase. So while anthropic's marketing may be hype there just wasn't much left to find, a point he makes in the blog post. Whether it's a big step forward for other kinds of projects is difficult to tell, but this highlights that everybody should be using AI…

None of those other LLM tooling made the claims they're too dangerous to be released and used though, unlike Anthropic did with Mythos. What it highlights, is that Mythos doesn't seem so much better than other LLM driven tooling at finding security issues, which was the strongest claim Anthropic made in the first place.

> None of those other LLM tooling made the claims they're too dangerous to be released and used though, unlike Anthropic did with Mythos.

I do think they've said similar things in the past, but regardless Anthropic's BS marketing is something to behold and viewing it with extreme skepticism is smart.

> What it highlights, is that Mythos doesn't seem so much better than other LLM driven tooling at finding security issues, which was the strongest claim Anthropic made in the first place.

That's the conclusion Daniel makes and it definitely seems plausible, his opinion absolutely carries a lot of weight with me for sure.

But I hedge a little because we don't really know how much human labor was required to supplement those earlier LLM-assisted reviews of curl, nor do we know how easy it was for the person who used Mythos to generate the new batch. So the kind of bug hunting that might be "possible but still labor intensive" via current tooling might be far easier to accomplish with less skilled developers using Mythos.

And who knows, maybe Mythos is better on worse codebases, curl benefits from being very good to start from :)

Re: Mythos Finds a Curl Vulnerability

#219

Post by zamadatix »

EMM_386 wrote: post #202

If an AI agent finds zero bugs in a software utility, how can that be viewed in the sense the AI agent is not very good at finding bugs? What if there are actually zero bugs? > Five issues felt like nothing as we had expected an extensive list. The expectation here may not match reality, but not necessarily because Mythos isn't as capable as claimed. curl may just happen to be a well-hardened tool that doesn't have t…

The author considered the same w.r.t. remaining bugs:

> More to find

> These were absolutely not the last bugs to find or report. Just while I was writing the drafts for this blog post we have received more reports from security researchers about suspected problems. The AI tools will improve further and the researchers can find new and different ways to prompt the existing AIs to make them find more.

> We have not reached the end of this yet.

> I hope we can keep getting more curl scans done with Mythos and other AIs, over and over until they truly stop finding new problems.

And that makes sense, it'd be quite the argument of coincidence to say there was just 1 proper find remaining & it was only Mythos that managed to find it just at the point in time it released while the other projects have been hoovering up every other find quickly until that point. Possible, but not the safest assumption to start questioning with.

Re: Mythos Finds a Curl Vulnerability

#220

Post by [deleted] »

u_fucking_dork wrote: post #206
NitpickLawyer wrote: post #121

What's going on in this thread? It's weird how prevalent the negativity towards mythos is, and I'm not sure if it's people throwing the baby out with the bathwater or something more tinfoil-adjacent coordinated campaign. I also noticed this on a thread a few days ago, before the mozilla post. There were dozens of comments saying basically "mythos is vaporware". I get the idea that they're using it for marketing. Of c…

> And then there's the team at mozilla And then there’s the team at curl. Don’t fall for the cheap marketing stuff just because you like them Everything points to Mythos being marginally better and nobody being able to afford to run it.

[deleted]
Post reply on HN