Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Has Mythos just broken the deal that kept the internet safe?

martinalderson.com

Post reply on HN
Print view View original

31–40 of 65 posts

Re: Has Mythos just broken the deal that kept the internet safe?

#31

Post by themafia »

PunchyHamster wrote: post #6
theamk wrote: post #2

> According to Anthropic, Mythos Preview successfully generates a working exploit for Firefox's JS shell in 72.4% of trials Why are AI people so dramatic? Ok, there is yet another JS sandbox escape - not the first one, not the last one. It will be patched, and the bar will be raised for a bit... at least until the next exploit is found. If anything, AI will make _weaponized_ exploits less likely. Before, one had to f…

> Before, one had to find a talented person, and get pretty lucky too. If this AI is as good as promised, you can have dependabot-style exploit finder running 24/7 for the 1/10th cost of a single FTE Not you. EVERYONE doing ANY kind of software will have to, because else attacker can just pick and choose targets to point their exploit-bot

> doing ANY kind of software

That's not at all clear. JS escape exploits have high value in our current Internet so there's going to be a lot of prior art. It's not surprising at all that this is what their model found and it's not a statistic that immediately suggest it has any broader implications.

Re: Has Mythos just broken the deal that kept the internet safe?

#32

Post by ryeights »

ur-whale wrote: post #11

[flagged]

Sorry, this guy is a hack and this is cope. Most of the things he's saying re: Mythos are objectively false.

- Open source models found the same bugs? Sure, if you tell them "here is a file which may contain a vulnerability, look for a bug in how function XYZ handles ABC"

- It's all mostly false positives? According to Anth, each suspected vulnerability came with a bug report and working PoC...

- "Humans had to fix the things"? As in, he thinks models are incapable of writing the patch?

Re: Has Mythos just broken the deal that kept the internet safe?

#33

Post by ryeights »

SkyPuncher wrote: post #22
theamk wrote: post #2

> According to Anthropic, Mythos Preview successfully generates a working exploit for Firefox's JS shell in 72.4% of trials Why are AI people so dramatic? Ok, there is yet another JS sandbox escape - not the first one, not the last one. It will be patched, and the bar will be raised for a bit... at least until the next exploit is found. If anything, AI will make _weaponized_ exploits less likely. Before, one had to f…

Further, Opus identified most of the vulnerabilities itself already. It just couldn’t exploit them. Mythos seems much, much more creative and self directed, but I’m not yet convinced the core capabilities are significantly higher than what’s possible today. The full price of finding the vulnerabilities was also something like $20k. That’s a price point that brings a skilled professional in to accomplish the same task…

Remember, that's the most expensive this capability will ever be.

Re: Has Mythos just broken the deal that kept the internet safe?

#34

Post by NooneAtAll3 »

Morromist wrote: post #30
readthenotes1 wrote: post #14

I tried to read the article and what I got out of it was that the author believes that the deal that keeps the internet safe is that we just don't try to break it hard enough. Ignoring all the state actors who do that all the time. Seems something of a unusual take on the state of the world

This is how a lot of the world works. Certain things aren't done very much because it takes a lot of human effort to do those things and that creates a status-quo. For example a lot more people would sue eachother for petty things if it suddenly became very easy and cost efficiant. Its not, so they dont. Another example of AI doing this exact type of thing in another realm: In the past convincing someone you were som…

(efficient)

Re: Has Mythos just broken the deal that kept the internet safe?

#35

Post by rvz »

This is instead another great advertisement for Rust. Anthropic really got the Mythos marketing scarecrows out once again.

Dario is trying to scare you to buying into his IPO and you're over-estimating the capability of Mythos...because he said so? With no independent reviews on the research and with many security researchers and experts accusing them of blatant scaremongering.

This is Anthropic's latest attempt to frame local models and to get them banned as they stand to be a threat against their business model.

Re: Has Mythos just broken the deal that kept the internet safe?

#36

Post by svnt »

theamk wrote: post #2

> According to Anthropic, Mythos Preview successfully generates a working exploit for Firefox's JS shell in 72.4% of trials Why are AI people so dramatic? Ok, there is yet another JS sandbox escape - not the first one, not the last one. It will be patched, and the bar will be raised for a bit... at least until the next exploit is found. If anything, AI will make _weaponized_ exploits less likely. Before, one had to f…

Ding ding ding, and this is why you are hearing about it. It is marketing for enterprise to pay a premium for the next model, with maybe a wakeup call to enforcement agencies as well (which is also marketing).

Codegen for many companies is much less continuous. Security is always on, and always a motivator.

Re: Has Mythos just broken the deal that kept the internet safe?

#37

Post by jMyles »

> the deal has been simple: you click a link, arbitrary code runs on your device, and a stack of sandboxes keeps that code from doing anything nasty.

At most, Mythos has reminded us that this "deal" is subject to frequent cycles of being compromised-and-patched.

From time to time, I have run browsers configured for opt-in javascript (eg, umatrix), but man it's a lot of work to live that way.

Re: Has Mythos just broken the deal that kept the internet safe?

#38

Post by localuser13 »

nine_k wrote: post #20
Shank wrote: post #16

Earlier quoted context omitted.

> I guess when an AI proves that P!=NP, What would be the practical impacts of this discovery?

Likely all existing cryptography would become crackable, possibly some of it, very readily.

Not really:

* It's possible - very likely even - that even if somehow P=NP, the fastest algorithm for any NP problem turns out to be something like n^1000, which is technically P, but not practical in any way.

* The proof may not be constructive, so we may just know that P=NP but it won't help us actually create an algorithm in P (nitpick: technically if P=NP there's a construction to create an algorithm that solves any NP problem in P time, but it's extremely slow - for example it involves iterating over all possible programs).

Re: Has Mythos just broken the deal that kept the internet safe?

#39

Post by ajross »

I honestly think this argument (that cheap vulnerabilities means more zero days) is backwards. Making vulnerability detection cheaper shifts the balance in favor of the good guys, because it dilutes the size of the black market that the discoverers might otherwise be tempted to sell into.

Stated differently: right now black hat hacking is a valuable skill that can be turned into money easily. Once everyone can do it the incentives shift and the black hats will disappear. And that leaves the next most incentivized group in control of the market, who are presumably the software vendors.

Basically Microsoft and Google and company used to have to pay bug bounties and pray. Now it's practical just to throw a few million dollars at Anthropic instead.

Re: Has Mythos just broken the deal that kept the internet safe?

#40

Post by SpicyLemonZest »

theamk wrote: post #2

> According to Anthropic, Mythos Preview successfully generates a working exploit for Firefox's JS shell in 72.4% of trials Why are AI people so dramatic? Ok, there is yet another JS sandbox escape - not the first one, not the last one. It will be patched, and the bar will be raised for a bit... at least until the next exploit is found. If anything, AI will make _weaponized_ exploits less likely. Before, one had to f…

Anthropic is saying exactly what you're saying. They don't believe that software security is permanently ruined. They just want to ensure that good defensive techniques like the ones you describe are developed before large numbers of attackers get their hands on the technology.
Post reply on HN