[dead]
Project Glasswing: Securing critical software for the AI era
441–450 of 921 posts
Re: Project Glasswing: Securing critical software for the AI era
#442Now, its very possible that this is Anthropic marketing puffery, but even if it is half true it still represents an incredible advancement in hunting vulnerabilities. It will be interesting to see where this goes. If its actually this good, and Apple and Google apply it to their mobile OS codebases, it could wipe out the commercial spyware industry, forcing them to rely more on hacking humans rather than hacking mobi…
its very possible that this is Anthropic marketing puffery
It isn't.
Re: Project Glasswing: Securing critical software for the AI era
#443Software has been doing fine without Misanthropic. These automated tools find very little. They selected the partners because they, too, want to keep up the illusion that AI works. Whenever a company pivots to "cyber" rhetoric, it is a clear indication that they are selling snake oil. Secure your girl school target selectors first.
This is a comment from someone that has never used these tools for vulnerability research. That much is very clear.
[dead]
Re: Project Glasswing: Securing critical software for the AI era
#444Now, its very possible that this is Anthropic marketing puffery, but even if it is half true it still represents an incredible advancement in hunting vulnerabilities. It will be interesting to see where this goes. If its actually this good, and Apple and Google apply it to their mobile OS codebases, it could wipe out the commercial spyware industry, forcing them to rely more on hacking humans rather than hacking mobi…
You should watch this talk by Nicholas Carlini (security researcher at Anthropic). Everything in the talk was done with Opus 4.6: https://www.youtube.com/watch?v=1sd26pWhfmg
[dead]
Re: Project Glasswing: Securing critical software for the AI era
#445> Mythos Preview identified a number of Linux kernel vulnerabilities that allow an adversary to write out-of-bounds (e.g., through a buffer overflow, use-after-free, or double-free vulnerability.) Many of these were remotely-triggerable. However, even after several thousand scans over the repository, because of the Linux kernel’s defense in depth measures Mythos Preview was unable to successfully exploit any of these…
That example you gave is extremely memorable as I recognised it as exactly one of the insanely stupid false positives that a highly praised (and expensive) static analyser I ran on a codebase several years ago would emit copiously.
Re: Project Glasswing: Securing critical software for the AI era
#446> Mythos Preview identified a number of Linux kernel vulnerabilities that allow an adversary to write out-of-bounds (e.g., through a buffer overflow, use-after-free, or double-free vulnerability.) Many of these were remotely-triggerable. However, even after several thousand scans over the repository, because of the Linux kernel’s defense in depth measures Mythos Preview was unable to successfully exploit any of these…
I agree the wording is a bit alarmist, but a closer example to what they are saying is: bool silly_mistake = false; //... lots of lines of code free(x); //... lots of lines of code if (silly_mistake) { // silly_mistake shown to be false at this point in the program in all testing, so far free(x); } A bug like above would still be something that would be patched, even if a way to exploit it has not yet been found, so…
That is something a good static analyser or even optimising compiler can find ("opaque predicate detection") without the need for AI, and belongs in the category of "warning" and nowhere near "exploitable". In fact a compiler might've actually removed the unreachable code completely.
Re: Project Glasswing: Securing critical software for the AI era
#447Society is about to pay a steep price for the software industry's cavalier attitude toward memory safety and control flow integrity.
[dead]
Re: Project Glasswing: Securing critical software for the AI era
#448One of the things I'm always looking at with new models released is long context performance, and based on the system card it seems like they've cracked it: GraphWalks BFS 256K-1M Mythos Opus GPT5.4 80.0% 38.7% 21.4%
[dead]
Re: Project Glasswing: Securing critical software for the AI era
#449> Mythos Preview identified a number of Linux kernel vulnerabilities that allow an adversary to write out-of-bounds (e.g., through a buffer overflow, use-after-free, or double-free vulnerability.) Many of these were remotely-triggerable. However, even after several thousand scans over the repository, because of the Linux kernel’s defense in depth measures Mythos Preview was unable to successfully exploit any of these…
Just because the plane can fly on one engine doesn't mean you don't fix the other engine when it fails.
[deleted]
Re: Project Glasswing: Securing critical software for the AI era
#450Earlier quoted context omitted.
I agree the wording is a bit alarmist, but a closer example to what they are saying is: bool silly_mistake = false; //... lots of lines of code free(x); //... lots of lines of code if (silly_mistake) { // silly_mistake shown to be false at this point in the program in all testing, so far free(x); } A bug like above would still be something that would be patched, even if a way to exploit it has not yet been found, so…
That is something a good static analyser or even optimising compiler can find ("opaque predicate detection") without the need for AI, and belongs in the category of "warning" and nowhere near "exploitable". In fact a compiler might've actually removed the unreachable code completely.
Well yeah, it’s a toy example to illustrate a point in an HN discussion :).
Imagine “silly mistake” is a parameter, and rename it “error_code” (pass by reference), put a label named “cleanup” right before the if statement, and throw in a ton of “goto cleanup” statements to the point the control flow of the function is hard to follow if you want it to model real code ever so slightly more.
It will be interesting to see the bugs it’s actually finding.
It sounds like they will fall into the lower CVE scores - real problems but not critical.