Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: Securing critical software for the AI era

anthropic.com

Post reply on HN
Print view View original

361–370 of 921 posts

Re: Project Glasswing: Securing critical software for the AI era

#361

Post by JumpCrisscross »

rakel_rakel wrote: post #196

> On the global stage, state-sponsored attacks from actors like China, Iran, North Korea, and Russia have threatened to compromise the infrastructure that underpins both civilian life and military readiness. AITA for thinking that PRISM was probably the state sponsored program affecting civilian life the most? And that one state is missing from the list here?

> PRISM was probably the state sponsored program affecting civilian life the most?

No state-sponsored hacking affected Americans materially. I just don't think we were networked enough in the 2010s. The risk is higher now since we're in a more warmongering world. (Kompromat on a power-plant technician is a risk in peace. It means blackouts in war.)

The fact that Iran hasn't been able to do diddly squat in America should sink in the fact that they didn't compromise us. (EDIT: blep. I was wrong.)

Re: Project Glasswing: Securing critical software for the AI era

#362

Post by Aperocky »

baq wrote: post #194
Aperocky wrote: post #176

Earlier quoted context omitted.

That's assuming the model is actually as good as they say it is. Given the amount of AI researchers over the past 3 years claiming supernatural capability from the LLM they have built, my bayesian skepticism is through the roof.

don't confuse bayesian skepticism with plain old contrarian bias. a true bayesian updates their priors, I'd say this is an appropriate time to do so. also don't confuse what they sell with what they have internally.

There haven't been any priors to update so far.

All LLMs got better for sure, but they are still definitively LLM and did not show any sign of having purpose. Which also made sense, because their very nature as statistical machines.

Sometimes quantity by itself lead to transformative change... but once, not twice, and that has already happened.

Re: Project Glasswing: Securing critical software for the AI era

#363

Post by SpicyLemonZest »

skejeke wrote: post #334
SpicyLemonZest wrote: post #332

Earlier quoted context omitted.

At many of the best tech companies, the conventional wisdom has always been that there's a huge backlog of stuff to be done. They don't want to deliver 100% of their roadmap with 50% of their employees, they want to deliver 200% of their roadmap with 100% of their employees. (And the speedup is not as high as these numbers imply for many kinds of performance, security, or correctness-critical software.) Some companie…

Lmao man this is absolute nonsense. Google has done nothing but destroy value with many of its ‘bets’. Your roadmap stuff is irrelevant - if you don’t have value creating projects in the pipeline and/or labour is augmented you should be laying off - period. Sundar’s job is to maximise the stock price. So once again - nonsense. Now stop spreading crap that clearly fills people with fear. I can tell you have no underst…

I'm spreading what people involved in management of tech firms have told me. Perhaps they were lying, but to me it seems consistent with what I observe in the news and in my personal capacity.

I'm also not quite sure your alternate theory is self-consistent. If Google has been frequently destroying value, and companies invariably lay people off when their projects aren't producing value, doesn't that mean they should have already been laying people off?

Re: Project Glasswing: Securing critical software for the AI era

#364

Post by [deleted] »

da_chicken wrote: post #357
jaidhyani wrote: post #267

Earlier quoted context omitted.

Said company is literally in court against said government at the moment, after said government attempted to designate it too dangerous to do business with.

There are currently over 1,000 companies involved in lawsuits against the US government right now even if we restrict ourselves to just tariff lawsuits .

[deleted]

Re: Project Glasswing: Securing critical software for the AI era

#365

Post by [deleted] »

jaidhyani wrote: post #267
ronsor wrote: post #230

Earlier quoted context omitted.

> Large American AI company does not list the US as an adversarial actor This is not a surprise or a gotcha.

Said company is literally in court against said government at the moment, after said government attempted to designate it too dangerous to do business with.

[deleted]

Re: Project Glasswing: Securing critical software for the AI era

#366

Post by JumpCrisscross »

Gigachad wrote: post #342
mcast wrote: post #328

Earlier quoted context omitted.

Lockdown mode is opt-in only though

It is, but if you are the kind of person these exploits are likely to target, you should have it on. So far there have been no known exploits that work in Lockdown Mode.

> if you are the kind of person these exploits are likely to target, you should have it on

You can also selectively turn it on in high-risk settings. I do so when I travel abroad or go through a border. (Haven't started doing it yet with TSA domestically. Let's see how the ICE fiasco evolves.)

Re: Project Glasswing: Securing critical software for the AI era

#367

Post by RALaBarge »

lilytweed wrote: post #67
jryio wrote: post #11

Let's fast forward the clock. Does software security converge on a world with fewer vulnerabilities or more? I'm not sure it converges equally in all places. My understanding is that the pre-AI distribution of software quality (and vulnerabilities) will be massively exaggerated. More small vulnerable projects and fewer large vulnerable ones. It seems that large technology and infrastructure companies will be able to…

I think we’re starting to glimpse the world in which those individuals or organizations who pigheadedly want to avoid using AI at all costs will see their vulnerabilities brutally exploited.

Botnet city: where everyone's a botnet, and the DDoS dont matter!

Re: Project Glasswing: Securing critical software for the AI era

#368

Post by toomuchtodo »

JumpCrisscross wrote: post #361
rakel_rakel wrote: post #196

> On the global stage, state-sponsored attacks from actors like China, Iran, North Korea, and Russia have threatened to compromise the infrastructure that underpins both civilian life and military readiness. AITA for thinking that PRISM was probably the state sponsored program affecting civilian life the most? And that one state is missing from the list here?

> PRISM was probably the state sponsored program affecting civilian life the most? No state-sponsored hacking affected Americans materially. I just don't think we were networked enough in the 2010s. The risk is higher now since we're in a more warmongering world. ( Kompromat on a power-plant technician is a risk in peace. It means blackouts in war.) The fact that Iran hasn't been able to do diddly squat in America sh…

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure - https://www.cisa.gov/news-events/cybersecurity-advisories/aa... - April 7th, 2026

Re: Project Glasswing: Securing critical software for the AI era

#369

Post by acdha »

josephg wrote: post #283

To be clear, we don’t know that this tool is better at finding bugs than fuzzing. We just know that it’s finding bugs that fuzzing missed. It’s possible fuzzing also finds bugs that this AI would miss.

Carlini talked about that a fair amount in the context of pairing the two: e.g. many protocols are challenging for fuzzers because they have something like a checksum or signature but LLMs are good at coming up with harnesses for things like that. I’m sure that we’re going to see someone building an integrated fuzzer soon which tries to do things like figure out how to get a particular branch to follow an unexercised path.

Re: Project Glasswing: Securing critical software for the AI era

#370

Post by slashdave »

9cb14c1ec0 wrote: post #52

Now, its very possible that this is Anthropic marketing puffery, but even if it is half true it still represents an incredible advancement in hunting vulnerabilities. It will be interesting to see where this goes. If its actually this good, and Apple and Google apply it to their mobile OS codebases, it could wipe out the commercial spyware industry, forcing them to rely more on hacking humans rather than hacking mobi…

Why wouldn't it be true? The cost is nothing compared to the bad PR if a bad actor took advantage of Anthropic's newest model (after release) to cause real damage. This gets in front of this risk, at least to some extent.
Post reply on HN