Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: Securing critical software for the AI era

anthropic.com

Post reply on HN
Print view View original

291–300 of 921 posts

Re: Project Glasswing: Securing critical software for the AI era

#291

Post by stephc_int13 »

tptacek wrote: post #223
stephc_int13 wrote: post #219

I think this is bad news for hackers, spyware companies and malware in general. We all knew vulnerabilities exist, many are known and kept secret to be used at an appropriate time. There is a whole market for them, but more importantly large teams in North Korea, Russia, China, Israel and everyone else who are jealously harvesting them. Automation will considerably devalue and neuter this attack vector. Of course thi…

I don't think it matters one way or the other to your thesis but I'm skeptical that state-level CNE organizations were hoarding vulnerabilities before; my understanding is that at least on the NATO side of the board they were all basically carefully managing an enablement pipeline that would have put them N deep into reliable exploit packages, for some surprisingly small N. There are a bunch of little reasons why the…

The economics would be different in say, North Korea, don't you think?

Re: Project Glasswing: Securing critical software for the AI era

#292

Post by 1attice »

boring-human wrote: post #212
throwaw12 wrote: post #29

Earlier quoted context omitted.

are we cooked yet? Benchmarks look very impressive! even if they're flawed, it still translates to real world improvements

Yep, I think the lede might be buried here and we're probably cooked (assuming you mean SWEs, but the writing has been on the wall for 4 months.) I guess I'm still excited. What's my new profession going to be? Longer term, are we going to solve diseases and aging? Or are the ranks going to thin from 10B to 10000 trillionaires and world-scale con-artist misanthropes plus their concubines?

Your new profession will be attempting to find enough gig work to eat. You will also be competing with self-driving taxis, so there's that as well.

Re: Project Glasswing: Securing critical software for the AI era

#294

Post by skejeke »

woeirua wrote: post #74
lilytweed wrote: post #67

Earlier quoted context omitted.

I think we’re starting to glimpse the world in which those individuals or organizations who pigheadedly want to avoid using AI at all costs will see their vulnerabilities brutally exploited.

[flagged]

lol and what about the vibe coders?

You people are comical. Why do you feel the need to create so much hype around what you say? Did you not get enough attention as a kid?

Re: Project Glasswing: Securing critical software for the AI era

#297

Post by conradkay »

bink wrote: post #210
conradkay wrote: post #98

Earlier quoted context omitted.

I would've basically agreed with you until I'd seen this talk: https://www.youtube.com/watch?v=1sd26pWhfmg Maybe a bad example since Nicholas works at Anthropic, but they're very accomplished and I doubt they're being misleading or even overly grandiose here See the slide 13 minutes in, which makes it look to be quite a sudden change

I watched the talk as well and it's very interesting. But isn't this just a buffer overflow in the NFS client code? The way the LLM diagnosed the flaw, demonstrated the bug, and wrote an exploit is cool and all, but doesn't this still come down to the fact that the NFS client wasn't checking bounds before copying a bunch of data into a fixed length buffer? I'm not sure why this couldn't have been detected with static…

I guess so, but there's a ton of buffer overflow vulnerabilities in the wild, and ostensibly it wasn't detected by static analysis

The red team post goes over some more impressive finds, and says that there's hundreds more they can't disclose yet: https://red.anthropic.com/2026/mythos-preview/

Re: Project Glasswing: Securing critical software for the AI era

#300

Post by nextaccountic »

IsTom wrote: post #293
atlgator wrote: post #266

[flagged]

FFmpeg has a lot of weird and not widely used codecs that don't get a lot of scrutiny. If there's no specifics then it could be a bug in one them.

this only makes things worse for ffmpeg

if someone sends you a malicious file that uses a rare codec and you open it, you will trigger this codepath that is not widely used and don't get a lot of scrutiny

Post reply on HN