51–60 of 65 posts
Standard disclosure rules should apply, give security stake holders 90-days of advance access, then release the model.
By that logic though the model would release 90 days from the last vulnerability it finds, so never.
The initial batch of publicly disclosed vulnerabilities by Mythos demonstrates that perfectly. None of the bugs themselves are especially interesting or complex, in my opinion. They were found by applying effort to a very large amount of code which included under-scrutinized areas, where bugs hid. Yes, even in projects like Linux and OpenBSD there are many pieces of code that aren't that properly vetted, because of the finite amount of developer/researcher time allotted.
The fact that this effort is much cheaper does indeed change things. But really strong sandboxing solutions, such as gvisor or firecracker, do a really good job of having very little attack surface, all of which is heavily scrutinized.
Until we see more of the bugs that were found, it remains to be seen whether or not the post's premise about sandboxes is correct.
I see this as a Brandolini's Law 2.0, a software supplemental really. Where-as before it was: > The amount of energy needed to refute bullshit is an order of magnitude bigger than that needed to produce it. Now the energy needed to secure against exploits is orders of magnitude bigger than the effort needed to secure it. The combination of deep expertise + infinite patience of the LLM meeting the vastly increasing su…
[flagged]
Sorry, this guy is a hack and this is cope. Most of the things he's saying re: Mythos are objectively false. - Open source models found the same bugs? Sure, if you tell them "here is a file which may contain a vulnerability, look for a bug in how function XYZ handles ABC" - It's all mostly false positives? According to Anth, each suspected vulnerability came with a bug report and working PoC... - "Humans had to fix t…
In one of Anthropic's blog post, they describe that that's basically what they did too. They run the agent many times, each time specifying a different file to focus on. [1]
From my experience as a security researcher, manually finding a fishy file and sicking even sonnet 4.5 yields great results for most memory corruption bugs.
No comments otherwise. I don't have a clue as to who that guy is, and I haven't watched the video yet. You might be right overall.
[1] https://red.anthropic.com/2026/mythos-preview/
Edit: looked at the open source model claims - I agree that they suck. Basically all the details are given away in the prompt - not just the file.
This is instead another great advertisement for Rust. Anthropic really got the Mythos marketing scarecrows out once again. Dario is trying to scare you to buying into his IPO and you're over-estimating the capability of Mythos...because he said so? With no independent reviews on the research and with many security researchers and experts accusing them of blatant scaremongering. This is Anthropic's latest attempt to f…
The double irony here is that the many projects being rewritten in Rust introduces a ton of new bugs simply due to the rewriting process, on top of using up a lot of dev effort
Earlier quoted context omitted.
Sorry, this guy is a hack and this is cope. Most of the things he's saying re: Mythos are objectively false. - Open source models found the same bugs? Sure, if you tell them "here is a file which may contain a vulnerability, look for a bug in how function XYZ handles ABC" - It's all mostly false positives? According to Anth, each suspected vulnerability came with a bug report and working PoC... - "Humans had to fix t…
> Open source models found the same bugs? Sure, if you tell them "here is a for which may contain a vulnerability, look for a big in how function XYZ handles ABC" In one of Anthropic's blog post, they describe that that's basically what they did too. They run the agent many times, each time specifying a different file to focus on. [1] From my experience as a security researcher, manually finding a fishy file and sick…
If OSS models are equally up to the task, why not find novel vulnerabilities?
Earlier quoted context omitted.
> Open source models found the same bugs? Sure, if you tell them "here is a for which may contain a vulnerability, look for a big in how function XYZ handles ABC" In one of Anthropic's blog post, they describe that that's basically what they did too. They run the agent many times, each time specifying a different file to focus on. [1] From my experience as a security researcher, manually finding a fishy file and sick…
Yes, but Anthropic didn’t already know the answers. In the OSS ‘reproductions’, they fed the model the one file that actually has a vuln and even told it which parts of the code to focus on. This is obviously a much easier task. If OSS models are equally up to the task, why not find novel vulnerabilities?
> If OSS models are equally up to the task, why not find novel vulnerabilities?
To be fair, in the same blog post Anthropic mentioned costs in the tens of thousands of dollars per project looked at it. So it's a big ask to do an experiment that compares. Would love to see it though.
Earlier quoted context omitted.
Further, Opus identified most of the vulnerabilities itself already. It just couldn’t exploit them. Mythos seems much, much more creative and self directed, but I’m not yet convinced the core capabilities are significantly higher than what’s possible today. The full price of finding the vulnerabilities was also something like $20k. That’s a price point that brings a skilled professional in to accomplish the same task…
Remember, that's the most expensive this capability will ever be.
No, you have not been safe all this time. Every security person I know has known for ages that you need to run NoScript to block all javascript if you want to be remotely secure on the web. We also know about all the 0days found on all browsers every year. Same for mobile devices. You have always been insecure. AI just makes it slightly faster to do what hackers have been doing for ages. BTW: Mythos is not new. OpenA…
> Anthropic's PR is so good that people genuinely don't understand that OpenAI's models are superior to Anthropic's That is a provocative statement that would be especially interesting if you were to add some supporting evidence.