Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Small models also found the vulnerabilities that Mythos found

aisle.com

Post reply on HN
Print view View original

321–330 of 372 posts

Re: Small models also found the vulnerabilities that Mythos found

#321

Post by chjj »

pertymcpert wrote: post #315
operatingthetan wrote: post #44

My theory is that Mythos is basically just Opus with revised context window handling and more compute thrown at it. So while it will be a step forward, it is probably primarily hype.

Shit. Really? You mean they modified their frontier model to improve it and make it better and just called it a day? That their benchmarks which show step change improvements are just the result of successive changes on an EXISTING MODEL ? Say it isn't so! I for one like to start from scratch each time I release my version of my compiler toolchain.

They didn't call it a day. They created an entire deceptive hype cycle around it.

Re: Small models also found the vulnerabilities that Mythos found

#322

Post by pseudohadamard »

philipallstar wrote: post #197
sumeno wrote: post #164

Earlier quoted context omitted.

Or $200,000 for consumers when they have to make a profit

Good point. This is why consumer phones have got much worse since 2005 and now cost millions of dollars.

With consumer phones you're not telling your customers "spend $200,000 with us to try and find holes before the bad guys do it". Commercial SAST tools have been around for 20 years and the pricing hasn't moved in all that time. With AI tools you've got a combination of the perfect hostage situation, pay for our stuff before others will find bad things about your product, and a desperate need to create the illusion of some sort of revenue stream, so I doubt prices will be dropping any time soon.

Re: Small models also found the vulnerabilities that Mythos found

#323

Post by nottorp »

kilpikaarna wrote: post #83
johnfn wrote: post #15

The Anthropic writeup addresses this explicitly: > This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings. While the specific run that found the bug above cost under $50, that number only makes sense with full hindsight. Like any…

Wasn't the scaffolding for the Mythos run basically a line of bash that loops through every file of the codebase and prompts the model to find vulnerabilities in it? That sounds pretty close to "any gold there?" to me, only automated. Have Anthropic actually said anything about the amount of false positives Mythos turned up? FWIW, I saw some talk on Xitter (so grain of salt) about people replicating their result with…

> Have Anthropic actually said anything about the amount of false positives Mythos turned up?

What? You want honest "AI" marketing?

Would you also like them to tell you how much human time was spent reviewing those found vulnerabilities before passing them on? And an unicorn delivered on Mars?

Re: Small models also found the vulnerabilities that Mythos found

#324

Post by felipeerias »

slopinthebag wrote: post #273
felipeerias wrote: post #251

Earlier quoted context omitted.

Anthropic gave the model the whole codebase and told it to find a vulnerability on a specific file, iterating across sessions focusing on different files. What happens then is that, for example, the model looks through that particular file, identifies potential problems, and works upwards through the codebase to check whether those could actually be hit. “Hum, here we assume that the input has been validated, is ther…

Mmm, Anthropic had a harness that had Mythos check each file as an entry point. That's not quite "here is a codebase, find vulns". A more sophisticated harness with a fast and cheap model could go function-by-function to do the same thing. Which is what this was validating. > The research discussed here provided models with just a known buggy function, missing the whole process required to find that bug in the first…

[dead]

Re: Small models also found the vulnerabilities that Mythos found

#325

Post by zelphirkalt »

epistasis wrote: post #119
elicash wrote: post #12

Earlier quoted context omitted.

This is from the first of the caveats that they list: > Scoped context: Our tests gave models the vulnerable function directly, often with contextual hints (e.g., "consider wraparound behavior"). A real autonomous discovery pipeline starts from a full codebase with no hints. The models' performance here is an upper bound on what they'd achieve in a fully autonomous scan. That said, a well-designed scaffold naturally…

If that's the point they are making, let's see their false positive rate that it produces on the entire codebase. They measured false negatives on a handful of cases, but that is not enough to hint at the system you suggest. And based on my experiences with $$$ focused eval products that you can buy right now, e.g. greptile, the false positive rate will be so high that it won't be useful to do full codebase scans thi…

How do we know the false positives for this "Mythos" thingamabob? Since they didn't release it, and we cannot reproduce it, are we to simply believe their word on this? What if the author of the featured article simply made a claim about that? We also simply believe their word? To me these AI tech companies are not any more trustworthy than a random blog author, maybe even less so, due to all the shady stuff they are pulling and especially since they have not released. Show or it didn't happen.

Re: Small models also found the vulnerabilities that Mythos found

#327

Post by kilroy123 »

muyuu wrote: post #255

I think the "Mythos" name is genius. The people at Anthropic make a bunch of claims and the public is expected to just believe them without any possibility of testing those claims or reproducing those results, and since so many people are invested in this saviour for the Global economy, or in the industry in general, or in hype to feed their engagement-based income sources, then there is faith to spare. Meanwhile thi…

Well said. I really hope the Chinese models keep getting better. Competition is good.

Re: Small models also found the vulnerabilities that Mythos found

#328

Post by adam_patarino »

kilpikaarna wrote: post #83
johnfn wrote: post #15

The Anthropic writeup addresses this explicitly: > This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings. While the specific run that found the bug above cost under $50, that number only makes sense with full hindsight. Like any…

Wasn't the scaffolding for the Mythos run basically a line of bash that loops through every file of the codebase and prompts the model to find vulnerabilities in it? That sounds pretty close to "any gold there?" to me, only automated. Have Anthropic actually said anything about the amount of false positives Mythos turned up? FWIW, I saw some talk on Xitter (so grain of salt) about people replicating their result with…

Anthropic has had the chance to explain what they did rationally. Instead they chose to be opaque and grandiose.

Giving them the benefit of the doubt is no longer appropriate.

Re: Small models also found the vulnerabilities that Mythos found

#330

Post by roxolotl »

alwillis wrote: post #304
roxolotl wrote: post #260

Earlier quoted context omitted.

I’ve got many catholic relatives that describe themselves as vegetarians and eat fish. Language can be surprisingly imprecise and dependent upon tons of assumptions.

> I’ve got many catholic relatives that describe themselves as vegetarians and eat fish Those are pescatarians. It's like how a tomato is a fruit, but it's used as a vegetable, meat has traditionally been the flesh of warm-blooded animals. Fish is the flesh of cold-blooded animals, making it meat but due to religious reasons it’s not considered meat.

Right exactly. The point is that dictionary definitions don’t always align with cultural ones.
Post reply on HN