Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Small models also found the vulnerabilities that Mythos found

aisle.com

Post reply on HN
Print view View original

271–280 of 372 posts

Re: Small models also found the vulnerabilities that Mythos found

#271

Post by eiens »

kennywinker wrote: post #29
chirau wrote: post #13

Their isolation approach is totally different from Mythos approach though. Mythos had to evaluate whole code bases rather than isolated sections. It's like saying one dog walked into the Amazon jungle and found a tennis ball and then another team isolated a 1 square kilometer radius that they knew the ball was definitely in and found the same ball.

I don’t think mythos can ingest an entire codebase into context. So it’s spinning off sub-agents to process chunks. Which supports their thesis: the harness is the moat. The tooling is whats important, the model is far far less important.

Let’s suppose that’s true

What’s so special about the harness - why wouldn’t others be able to replicate it?

Re: Small models also found the vulnerabilities that Mythos found

#272

Post by johnfn »

eiens wrote: post #262
johnfn wrote: post #248

Earlier quoted context omitted.

Your proof-in-pudding test seems to assume that AI is binary -- either it accelerates everyone's development 100x ("let's rewrite every app into bug-free native applications") or nothing ("there hasn't been anything to show for that in years"). I posit reality is somewhere in between the two.

LLM’s are capable of searching information spaces and generating some outputs that one can use to do their job. But it’s not taking anyone’s job, ever. People are not bots, a lot of the work they do is tacit and goes well beyond the capabilities and abilities of llm’s. Many tech firms are essentially mature and are currently using too much labour. This will lead to a natural cycle of lay offs if they cannot figure ou…

In this entire thread of conversation, I never said that LLMs would take people's jobs, and that is not something I believe.

Re: Small models also found the vulnerabilities that Mythos found

#273

Post by slopinthebag »

felipeerias wrote: post #251
slopinthebag wrote: post #172

Earlier quoted context omitted.

Idk, it seems reasonable to me > "Our tests gave models the vulnerable function directly, often with contextual hints. A real autonomous discovery pipeline starts from a full codebase with no hints. The models' performance here is an upper bound on what they'd achieve in a fully autonomous scan. That said, a well-designed scaffold naturally produces this kind of scoped context through its targeting and iterative prom…

Anthropic gave the model the whole codebase and told it to find a vulnerability on a specific file, iterating across sessions focusing on different files. What happens then is that, for example, the model looks through that particular file, identifies potential problems, and works upwards through the codebase to check whether those could actually be hit. “Hum, here we assume that the input has been validated, is ther…

Mmm, Anthropic had a harness that had Mythos check each file as an entry point. That's not quite "here is a codebase, find vulns". A more sophisticated harness with a fast and cheap model could go function-by-function to do the same thing. Which is what this was validating.

> The research discussed here provided models with just a known buggy function, missing the whole process required to find that bug in the first place.

That process can be made part of a harness, again which is what they were validating.

I'm not sure why people are so hell-bent on disparaging open source models here. I get that some people cant get results from them, but that's just a skill issue - we should all be ecstatic that we don't need to rely on the unethical AI corps to allow us to do our jobs.

Re: Small models also found the vulnerabilities that Mythos found

#274

Post by apgwoz »

Filligree wrote: post #246
nozzlegear wrote: post #205

Earlier quoted context omitted.

> There is absolutely zero reason to believe you could use this same approach to find and exploit vulns without Mythos finding them first. There's one huge reason to believe it: we can actually use small models, but we cant use Anthropic's special marketing model that's too dangerous for mere mortals.

If all you have is a spade, that is _not_ evidence that spades are good for excavating an entire hill.

It takes longer, but a spade is better than bare hands. The goal is to speed up finding valid vulnerabilities, and be faster than humans can do it.

Re: Small models also found the vulnerabilities that Mythos found

#275

Post by maevyn11 »

tptacek wrote: post #20

If you cut out the vulnerable code from Heartbleed and just put it in front of a C programmer, they will immediately flag it. It's obvious. But it took Neel Mehta to discover it. What's difficult about finding vulnerabilities isn't properly identifying whether code is mishandling buffers or holding references after freeing something; it's spotting that in the context of a large, complex program, and working out how a…

Yea I think if you read the actual design of the test they are presenting as evidence it shows that what these small models are doing is not the same as what Mythos did. They isolated the vulnerable code down to the vulnerable subset of the function and provided hints in the prompt about all of the key contextual factors that matter to finding the vulnerability. That makes the problem significantly easier.

I realize they are trying to prove that an agentic harness running small models can ultimately achieve the same thing as what Mythos did, but they are handwaving away the steps it takes to construct the context Mythos handled in model and using a misleading test result to prove small models can handle the key step.

Poor evidence of a premise that logically wouldn't even be proven if the their evidence was valid. If they could find these types of vulnerabilities with the same effectiveness they would have done it already.

Re: Small models also found the vulnerabilities that Mythos found

#276

Post by grandinquistor »

felipeerias wrote: post #261
StrauXX wrote: post #222

A lot of comments here are dismissing this post because the relevant code was isolated. But thats the exact same thing Anthropic did with Mythos! They describe their (very lean) harness in the Anthropic Red Mythos blog post. The harness first assigns each file in the given codebase an importance value. Then points claude code at the cpdebase with a prompt stating that it should focus on that file. It spawns a claude…

From the article: > Our tests gave models the vulnerable function directly, often with contextual hints (e.g., "consider wraparound behavior").

I mean you can still scale that? Ask a lighter model to go through every function to find vulnerabilities, take output to bigger model like Opus and classify the critical ones.

Re: Small models also found the vulnerabilities that Mythos found

#277

Post by phire »

tokioyoyo wrote: post #264
muyuu wrote: post #255

I think the "Mythos" name is genius. The people at Anthropic make a bunch of claims and the public is expected to just believe them without any possibility of testing those claims or reproducing those results, and since so many people are invested in this saviour for the Global economy, or in the industry in general, or in hype to feed their engagement-based income sources, then there is faith to spare. Meanwhile thi…

There are two possibilities: a) Anthropic is lying, and every company that is collaborating on vulnerability squishing project is an accomplice in this big lie b) Anthropic has then goldest gold of the shovels to sell to people, which is actually useful for enterprises Everyone, including Ant, understands that other companies will catch up in terms of model strength. So it’s a damned if you do, damned if you don’t po…

The model is probably legitimately better. But it might not be enough better to justify the extra cost of inference.

They know if they released it publicly, people will be able to see exactly how smart it is, and adjust their demand correspondingly. Anthropic will either need to price it high enough that nobody uses it (and the hardware is sitting mostly idle to servicing a few customers), or lower their profit margins (potentially below cost) to price it fairly.

So instead, they bundle it with this fancy new exploit finding scaffold, and sell the combined it to enterprise customers. I bet the scaffold works fine with smaller models, but gets notably improved results with Mythos.

The two products support each-other, and with the exclusive bundle Anthropic can get more profit selling both together than they would get selling them individually.

And as an added bonus, people over estimate the capability of this unreleased model, providing hype for Anthropic.

Re: Small models also found the vulnerabilities that Mythos found

#279

Post by doginasuit »

nodja wrote: post #204
mirsadm wrote: post #80

Earlier quoted context omitted.

How is that going to find anything that interacts across files?

You misunderstood. Instead of asking the model: "Here's this codebase, report any vulnerability." you ask. "Here's this codebase, report any vulnerability in module\main.c". The model can still explore references and other files inside the codebase, but you start over a new context/session for each file in the codebase.

Honestly, that's the only way I've ever been able to trust the output. Once you go beyond the scope of one file it really degrades. But within a single file I've seen amazing results.

Re: Small models also found the vulnerabilities that Mythos found

#280

Post by eru »

eiens wrote: post #266
MidnightRider39 wrote: post #236

Earlier quoted context omitted.

Leadership is also a very human thing. I think most people would balk at the idea of being led by an LLM. One of the main functions of leaders (should be) is to assume responsibility for decisions and outcomes. A computer cant do that. And finally why should someone in power choose to replace themselves?

Someone in power doesn’t get to choose - the board of directors do. Who’s job is to act in the best interest of shareholders. Firms tend to follow peers in an industry - once one blinks the rest follow.

> Someone in power doesn’t get to choose - the board of directors do. Who’s job is to act in the best interest of shareholders.

Alas, shareholder value is a great ideal, but it tends to be honoured in practice rather less strictly.

As you can also see when sudden competition leads to rounds of efficiency improvements, cost cutting and product enhancements: even without competition, a penny saved is a penny earned for shareholders. But only when fierce competition threatens to put managers' jobs at risk, do they really kick into overdrive.

Post reply on HN