Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: An Initial Update

anthropic.com

Post reply on HN
Print view View original

231–240 of 345 posts

Re: Project Glasswing: An Initial Update

#231

Post by s3p »

mukmuk wrote: post #122

I’m not sure how to reconcile anthropic’s update / some of the exuberant comments here with recent feedback like the following from curl maintainer Daniel Steinberg: “I see no evidence that this setup [Mythos] finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to…

Curl, according to the authors own admission, is the most heavily tested and fuzzed open source library out there. So I think for him it's a different situation

Re: Project Glasswing: An Initial Update

#232

Post by koliber »

winstonwinston wrote: post #54
mdeeks wrote: post #34

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the "Low" findings…

> I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. So, how is that supposed to work? Claude Code generates security bugs, then Claude Security finds them, then Claude Code generate fix, spend tokens, profit?

Replace “Claude code” with “programmers” and you get what we’ve had up until now. It’s all just moving quicker now.

Re: Project Glasswing: An Initial Update

#233

Post by dingaling »

jimbokun wrote: post #104
jimmy2times wrote: post #58

Earlier quoted context omitted.

The AIs have already figured out how to succeed in a software job: 1. Ship bugs 2. Fix them 3. You're the hero!

Dilbert beat you to it: https://english.stackexchange.com/questions/488178/what-does...

The non-programmer decomposition of that joke was painful to read.

Particularly from those outside the domain who criticised it as a 'not a very good joke' because they didn't understand it, which I think summarises the entitled mindset of many people these days.

Re: Project Glasswing: An Initial Update

#234

Post by Dilettante_ »

mncharity wrote: post #201
ygjb wrote: post #101

Earlier quoted context omitted.

> the developers learn from mistakes and avoid them in the future No. Humans learn from mistakes and try to avoid them in the future, but there is a whole pile of other stuff in the bag of neurons between our ears that prevent us from avoiding repetition of errors. I have seen extremely talented engineers write trivial to avoid memory corruption bugs because they were thinking about the problem they were trying to so…

> write trivial to avoid memory corruption bugs because they were thinking about [something else] [...] defects [...] written by people that know better, but the bug introduced was orthogonal to [their focus] For whatever reason, hadn't associated the inattentional blindness of bug writing with the invisible gorilla experiment and car crashes - selective attention fails. People looking right at the gorilla strolling…

Thank you in turn for making the issue much more salient to me by explicitly connecting it to the gorilla/basketball experiment. This is definitely going into my "clippings".

Re: Project Glasswing: An Initial Update

#235

Post by rsync »

icedchai wrote: post #153
rsync wrote: post #48

I asked in a different thread: Do we have a sense that projects like OpenBSD/OpenSSH, FreeBSD, ISC[1] and Apache were included in the "blessed" initial participants in Project Glasswing ? Or is it big name tech companies, banks and fashionable languages and package managers ? [1] Bind, DHCP

Probably? FreeBSD has had a large increase in security advisories the past couple months. More in the last two months than all of 2025 combined.

Those advisories all came from outside sources, most notably calif.io.

It's not clear to me that FreeBSD found any of them internally ...

Re: Project Glasswing: An Initial Update

#236

Post by kortilla »

mdeeks wrote: post #34

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the "Low" findings…

It seems to me like either your architecture is fucked up or you’re using the wrong language/tooling for the type of software you are making if you’re introducing security vulnerabilities that frequently.

Re: Project Glasswing: An Initial Update

#238

Post by Smaug123 »

hollowturtle wrote: post #132
mdeeks wrote: post #34

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the "Low" findings…

> I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. Dude is flexing that he's pushing unsecure code every day, that's a skill!

By the way, you might be interested in looking up “blameless post-mortems” and indeed the field of incident response more generally. Modern incident response practice is to treat failures of an individual to do something as problems with the system they were operating in, because humans aren’t designed to be consistent or perfect and therefore shouldn’t be pretended or assumed to be.

Re: Project Glasswing: An Initial Update

#239

Post by Smaug123 »

gck1 wrote: post #100
nikcub wrote: post #50

There has been a lot of cynicism around mythos, that it's just the usual public models without guardrails, etc. etc. but this: > 1,752 of those high- or critical-rated vulnerabilities have now been carefully assessed by one of six independent security research firms, or in a small number of cases by ourselves. Of these, 90.6% (1,587) have proved to be valid true positives, and 62.4% (1,094) were confirmed as either h…

> This is why I believe mythos will remain private for the foreseeable future. There's such a large surface that needs to be secured and so much to triage, fix, deploy. sigh I remember the GPT-2 days - when it was the first time OpenAI restricted access to the models citing "humanity is not ready for it". The model was good at writing poetry or something. Since then, I don't remember a single model announcement from…

It’s still not clear to me that humanity was ready for GPT-2! Quite a lot of people claim to hate and fear LLMs. https://www.kcl.ac.uk/news/one-in-five-britons-think-ai-will... or https://yougov.com/en-us/articles/54762-most-americans-say-a... for example.
Post reply on HN