Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Small models also found the vulnerabilities that Mythos found

aisle.com

Post reply on HN
Print view View original

331–340 of 372 posts

Re: Small models also found the vulnerabilities that Mythos found

#331

Post by glerk »

johnfn wrote: post #163
glerk wrote: post #146

Earlier quoted context omitted.

I'm having trouble finding this info (I assume they won't publish it), but could the secret sauce be much larger and more readily accessible context window? OpenBSD's code is in the 10s of millions of lines. Being able to hold all of it in context would make bug finding much easier.

You can look at some of the bugs, if you'd like. They are (at least the ones I looked at) fairly self-contained, scoped to a single function, a hundred lines or less. There's no need for a massive amount of context.

Interesting, and you are absolutely right (hehe).

These are pretty self-contained and seems to be something more like "formal verification" where the model is able to simulate a large number of states and find incorrect ones, if I were to speculate, something akin to a reasoning loop that moved from the harness/orchestration layer down to the model itself.

Re: Small models also found the vulnerabilities that Mythos found

#332

Post by adrian_b »

philipallstar wrote: post #197
sumeno wrote: post #164

Earlier quoted context omitted.

Or $200,000 for consumers when they have to make a profit

Good point. This is why consumer phones have got much worse since 2005 and now cost millions of dollars.

If I want to buy today a smartphone that is positioned on the market at the same level as what I was buying for around $500 seven-eight years ago, now I have to spend well over $1000, a price increase between 2 and 3 times.

So your example is not well chosen.

Price increases have affected during the last decade many computing and electronics devices, though for most of them the price increases have been less than for smartphones.

Re: Small models also found the vulnerabilities that Mythos found

#333

Post by Eug894 »

doginasuit wrote: post #279
nodja wrote: post #204

Earlier quoted context omitted.

You misunderstood. Instead of asking the model: "Here's this codebase, report any vulnerability." you ask. "Here's this codebase, report any vulnerability in module\main.c". The model can still explore references and other files inside the codebase, but you start over a new context/session for each file in the codebase.

Honestly, that's the only way I've ever been able to trust the output. Once you go beyond the scope of one file it really degrades. But within a single file I've seen amazing results.

Are you not supposed to include as many _preconditions_ (in the form of test cases or function constraints like "assert" macro in C) as you can into your prompt describing an input for a particular program file before asking AI to analyze the file?

Please, read my reply to one of the authors of Angr, a binary analysis tool. Here is an excerpt:

> A "brute-force" algorithm (an exhaustive search, in other words) is the easiest way to find an answer to almost any engineering problem. But it often must be optimized before being computed. The optimization may be done by an AI agent based on neural nets, or a learning Mealy machine.

> Isn't it interesting what is more efficient: neural nets or a learning Mealy machine?

...Then I describe what is a learning Mealy machine. And then:

> Some interesting engineering (and scientific) problems are: - finding an input for a program that hacks it; - finding a machine code for a controller of a bipedal robot, which makes it able to work in factories;

https://x.com/NENENENENE10/status/2042733015281914108

Re: Small models also found the vulnerabilities that Mythos found

#334

Post by HarHarVeryFunny »

Most of the comments here seems to be responding to the issue of finding vulnerabilities, rather than exploiting them, but the Anthropic claim is that the Mythos advance is being able to actually develop exploits whereas Opus 4.6 had been able to find vulnerabilities, but was poor at being able to develop exploits for them.

It's also noteworthy that Anthropic attributes Mythos' improvement to advances in "coding, reasoning and autonomy", and that the autonomy part seems especially important since they go on to say that trying to develop exploits included adding debug code to projects, running them under a debugger, etc.

When comparing the capabilities of Mythos to previous generation and/or smaller models, it seems it would therefore be useful to distinguish between identifying potential vulnerabilities and actually trying to build exploits for them in agentic fashion. Finding the "needle in a haystack" (potential vulnerability) is one aspect, but the other part is an agentic exploit-writing harness being handed the needle and asked to try to exploit it.

I wonder how much effort Anthropic put into building the harnesses and environments for Mythos to run, modify and debug code? For example, was Mythos set up to be able to build and run a modified BSD in some virtual environment, or did it just take suspect functions and test those in isolation?

It'd be interesting to put the capabilities of Opus 4.6, Mythos, and other models into perspective by comparing them to traditional non-AI static analysis security scanning tools. Anthropic mention that the open source projects they scanned came from the OSS-Fuzz corpus, but as far as I can see they don't say what other tools have, or have not, been used to scan these projects.

It'd also be interesting to know to what extent Mythos was explicitly RL trained to develop exploits (especially since it sounds as if Anthropic have the dataset and environment needed to do this) as opposed to this just being a natural consequence of the model being better. If this was the case then it might be a large part of why they are not releasing it - can't really position yourself as strong on security if you deliberately develop and release a hacking tool!

Re: Small models also found the vulnerabilities that Mythos found

#335

Post by snovv_crash »

adrian_b wrote: post #332
philipallstar wrote: post #197

Earlier quoted context omitted.

Good point. This is why consumer phones have got much worse since 2005 and now cost millions of dollars.

If I want to buy today a smartphone that is positioned on the market at the same level as what I was buying for around $500 seven-eight years ago, now I have to spend well over $1000, a price increase between 2 and 3 times. So your example is not well chosen. Price increases have affected during the last decade many computing and electronics devices, though for most of them the price increases have been less than for…

If you want the level of storage, screen resolution and camera quality as a $500 phone from 8 years ago, you can get that for $250 today.

Of course their marketing team tries to convince you to spend more money. That doesn't mean you have to.

Re: Small models also found the vulnerabilities that Mythos found

#336

Post by naasking »

jorvi wrote: post #227
johnfn wrote: post #154

Earlier quoted context omitted.

Admittedly just vibes from me, having pointed small models at code and asked them questions, no extensive evaluation process or anything. For instance, I recall models thinking that every single use of `eval` in javascript is a security vulnerability, even something obviously benign like `eval("1 + 1")`. But then I'm only posting comments on HN, I'm not the one writing an authoritative thinkpiece saying Mythos actual…

My proof-in-pudding test is still the fact that we haven't seen gigantic mass firings at tech companies, nor a massive acceleration on quality or breadth (not quantity!) of development. Microsoft has been going heavy on AI for 1y+ now. But then they replace their cruddy native Windows Copilot application with an Electron one. If tests and dev only has marginal cost now, why aren't they going all in on writing extreme…

> My proof-in-pudding test is still the fact that we haven't seen gigantic mass firings at tech companies

Jevon's paradox.

Re: Small models also found the vulnerabilities that Mythos found

#337

Post by naasking »

Filligree wrote: post #246
nozzlegear wrote: post #205

Earlier quoted context omitted.

> There is absolutely zero reason to believe you could use this same approach to find and exploit vulns without Mythos finding them first. There's one huge reason to believe it: we can actually use small models, but we cant use Anthropic's special marketing model that's too dangerous for mere mortals.

If all you have is a spade, that is _not_ evidence that spades are good for excavating an entire hill.

> If all you have is a spade, that is _not_ evidence that spades are good for excavating an entire hill.

If you have an automated spade, that's still often better for excavating that hill than you using a shovel by hand.

Re: Small models also found the vulnerabilities that Mythos found

#338

Post by vel0city »

rakel_rakel wrote: post #187
paulddraper wrote: post #182

Earlier quoted context omitted.

You don’t see the value of vulnerabilities as on the order of 20k USD? When it’s a security researcher, HN says that’s a squalid amount. But when its a model, it’s exorbitant.

If I understand you correctly, you're asking me if I would class this as a 20k USD (plus environmental and societal impact) bug? nope, I don't. I've not said anything else than that I think this specific bug isn't worth the attention it's getting, and that 20k USD would benefit the OpenBSD project (much) more through the foundation. > When it’s a security researcher, HN says that’s a squalid amount. But when its a mo…

> you're asking me if I would class this as a 20k USD (plus environmental and societal impact) bug?

Not this bug in particular as a single bug bounty, but as an entire codebase audit that exposed multiple bugs? Sure.

Re: Small models also found the vulnerabilities that Mythos found

#339

Post by [deleted] »

mattmanser wrote: post #303
wat10000 wrote: post #242

Earlier quoted context omitted.

It’s strange to see this constant “I could do that too, I just don’t want to” response. Finding an important decades-old vulnerability in OpenBSD is extremely impressive. That’s the sort of thing anyone would be proud to put on their resume. Small models are available for anyone to use. Scaffolding isn’t that hard to build. So why didn’t someone use this technique to find this vulnerability and make some headlines be…

Why are you EXTREMELY impressed? The level of hysteria and lack of objective thought by pro-AI people on this thread is extremely concerning. Vulnerabilities are found every day. More will be found. They claim they spent $20k finding one, probably more like $20 million if you actually dug into it. And if you took into account inference, more like $2 billion. The reason why no-one's done it is because it's not worth t…

[deleted]

Re: Small models also found the vulnerabilities that Mythos found

#340

Post by roywiggins »

cycomanic wrote: post #300
wat10000 wrote: post #242

Earlier quoted context omitted.

It’s strange to see this constant “I could do that too, I just don’t want to” response. Finding an important decades-old vulnerability in OpenBSD is extremely impressive. That’s the sort of thing anyone would be proud to put on their resume. Small models are available for anyone to use. Scaffolding isn’t that hard to build. So why didn’t someone use this technique to find this vulnerability and make some headlines be…

From the article: >At AISLE, we've been running a discovery and remediation system against live targets since mid-2025: 15 CVEs in OpenSSL (including 12 out of 12 in a single security release, with bugs dating back 25+ years and a CVSS 9.8 Critical), 5 CVEs in curl, over 180 externally validated CVEs across 30+ projects spanning deep infrastructure, cryptography, middleware, and the application layer. They have been…

They could have linked their replication in this blog post, which we did all see, if they have one.
Post reply on HN