Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: An Initial Update

anthropic.com

Post reply on HN
Print view View original

241–250 of 345 posts

Re: Project Glasswing: An Initial Update

#241

Post by teiferer »

winstonwinston wrote: post #54
mdeeks wrote: post #34

You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the "Low" findings…

> I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. So, how is that supposed to work? Claude Code generates security bugs, then Claude Security finds them, then Claude Code generate fix, spend tokens, profit?

All my sibling comments are missing the message here which is that if Claude can find security issues then it can avoid them right when writing the code, so it could just never commit anything containing a security issue.

Re: Project Glasswing: An Initial Update

#242

Post by scrollaway »

ashdksnndck wrote: post #196
amazingamazing wrote: post #188

Earlier quoted context omitted.

What are you talking about?

I’ll try to steelman this comment. Anyone who uses coding tools knows that the output is heavily affected by details of the task you give it. The same model can give you garbage code or genius code for the same problem with slightly different framing. So it’s not necessarily a limitation in the model’s training that causes it to output security bugs. The model might be great at writing secure code, but you need a dif…

I guess I thought this should be obvious to everyone but, looking at code and finding exploits is completely different from .. writing exploits.

For one thing exploits often require completely different parts of the code to chain together. Sometimes parts of code the LLM itself isn’t writing.

And, LLMs are ALREADY trained negatively against writing buggy or exploitable code.

Re: Project Glasswing: An Initial Update

#243

Post by solenoid0937 »

nozzlegear wrote: post #221
solenoid0937 wrote: post #180

Earlier quoted context omitted.

When you reach that ideal world, let me know. My company has thrown a decade+ and multiple teams at the idea you've described. We still aren't there yet. Your proposal of relying purely on static analysis is over-idealistic and just not feasible for large, diverse codebases in the real world. That's where AI comes in.

> Your proposal of relying purely on static analysis is over-idealistic and just not feasible for large, diverse codebases in the real world. "Just not feasible" is thought terminating, but regardless, I thought we were talking about ideals? Ideally you want the static analysis to work, not to rely on the non-deterministic bullshitter.

> piss away yet more tokens

> non-deterministic bullshitter.

You're so ideologically opposed to AI that you bury your head in the sand in cases where it genuinely does a fantastic job today, right now, in the real world (like developing end to end exploits using noisy signals like static analysis results, fuzzer results, etc).

Instead you assert that we should go a route no company has successfully proven out despite throwing billions of dollars and some of the best cybersecurity talent in the world at.

Anyways, if you develop a static analysis solution that works across large, diverse production codebases and develops end to end working exploits without AI, I will literally buy it off you for millions of dollars. Or you could start your own company. You'd be an overnight decabillionaire.

Re: Project Glasswing: An Initial Update

#246

Post by nullbio »

mdeeks wrote: post #230
gofreddygo wrote: post #199

Earlier quoted context omitted.

This got me thinking, so what happens in two years? every tom, dick and harry who can type english has the tools to attack any software that isn't patched. tools that were accessible to specialized groups, now made available to anybody with a grudge and a few dollars for tokens. and what does anthropic and openai do? They form an inner ring to make the latest models available first to Enterprises. Enterprises will co…

Two years? That exists right now. You only have to point Codex Security at an open source repo. There are a lot of tools and companies that are spinning up today that do autonomous pentesting. I'm not even sure a specialized model is needed here. It probably just needs the right harness around existing ones. I expect the next two years to be absolutely brutal for hacks. Attackers have supercharged tools in their hand…

> The major short term downside is that open source or personal projects won't be able to afford things like Codex Security.

Realistically, all open-source projects should be forced to have automated scans of this nature before their releases can be shipped. This is something the package managers and github need to figure out. It'd stop the supply chain attacks too.

Re: Project Glasswing: An Initial Update

#249

Post by dyauspitr »

solenoid0937 wrote: post #174
gck1 wrote: post #163

Earlier quoted context omitted.

> haven't been disclosed, because they're not fixed. That's convinient. But wait, don't they have this amazing AI that can fix all the issues itself with a single /goal command? What's the holdup?

You should really read the article, every question asked so far in this thread has been very clearly answered. I miss the days when HN would RTFA.

He doesn’t want to read the article. He just wants to LLM bad.

Re: Project Glasswing: An Initial Update

#250

Post by fragmede »

jxmesth wrote: post #209

Does anyone know how we can get access to this? We're a financial institution, pretty well known locally but not internationally. Can we request access directly or maybe via bedrock/azure?

Not from Anthropic, but OpenAI's Codex Security is. https://developers.openai.com/codex/security/setup
Post reply on HN