Has Mythos just broken the deal that kept the internet safe? • Hacker News Board

Re: Has Mythos just broken the deal that kept the internet safe?

#61

Post by jjav » Sat, Apr 11, 2026, 9:11 AM UTC

RandomGerm4n wrote: post #60

Hopefully, this will finally lead to a shift in thinking so that security practices like those used in GrapheneOS become more widespread in the future. Most software developers simply patch security vulnerabilities as soon as they become aware of them rather than taking preventive measures where possible. Finding an exploit that works in Vanadium on GrapheneOS is significantly harder than on standard Android running…

> Hopefully, this will finally lead to a shift in thinking so that security practices like those used in GrapheneOS become more widespread in the future. Most software developers simply patch security vulnerabilities as soon as they become aware of them rather than taking preventive measures where possible.

Working in this space, I'm worried the future is even more reactive than today. Today I can get teams to review for security the architecture before implementing, and to review the implementation for security before shipping.

As teams move (more specifically, are forced to move) to vibe coding the whole thing, nobody knows what the design is or what the implementation looks like. Vibe all the way because the CEO says so or you're fired. This means the only place to catch vulnerabilities becomes after the fact, which is usually too late.

Re: Has Mythos just broken the deal that kept the internet safe?

#62

Post by robocat » Sat, Apr 11, 2026, 9:22 AM UTC

localuser13 wrote: post #43

p-e-w wrote: post #13

Earlier quoted context omitted.

You’re asking why people are being “dramatic” about an automated system that can do what highly specialized experts get paid hundreds of thousands of dollars to do? It’s just fascinating to see how AI’s accomplishments are being systematically downplayed. I guess when an AI proves that P!=NP, I’m going to read on this forum “so what, mathematicians prove conjectures all the time, and also, we pretty much always knew…

I am sceptical because AI companies, and anthropic in particular, like to overplay their achievements and build undeserved hype. I also don't understand all the caveats (maybe official announcement is more clear what this really means). But yeah, if their model can reliably write an exploit for novel bugs (starting from a crash, not a vulnerable line of code) then it's very significant. I guess we'll see, right? edit…

The interesting thing is that within a year we will know whether it is vapid hype or a momentous change.

Scepticism means staying wary and keeping one's mind open, and not closing your eyes to a new reality.

Re: Has Mythos just broken the deal that kept the internet safe?

#63

Post by robocat » Sat, Apr 11, 2026, 9:30 AM UTC

jMyles wrote: post #37

> the deal has been simple: you click a link, arbitrary code runs on your device, and a stack of sandboxes keeps that code from doing anything nasty. At most, Mythos has reminded us that this "deal" is subject to frequent cycles of being compromised-and-patched. From time to time, I have run browsers configured for opt-in javascript (eg, umatrix), but man it's a lot of work to live that way.

And JavaScript is only one vector.

Heaps of prior examples of buffer overruns processing image formats, or the FFmpeg mentioned by Anthropic's Mythos article.

Admittedly JavaScript is often used as part of a chain to simplify attack (e.g. repeating heap spray to attack a use-after-free reliably).

The interesting part is that Anthropic have talked about automating finding vulnerabilities and also automating exploitation of those vulnerabilities.

Re: Has Mythos just broken the deal that kept the internet safe?

#64

Post by chjggjjvjjtoo » Fri, Apr 17, 2026, 3:20 AM UTC

theamk wrote: post #2

> According to Anthropic, Mythos Preview successfully generates a working exploit for Firefox's JS shell in 72.4% of trials Why are AI people so dramatic? Ok, there is yet another JS sandbox escape - not the first one, not the last one. It will be patched, and the bar will be raised for a bit... at least until the next exploit is found. If anything, AI will make _weaponized_ exploits less likely. Before, one had to f…

Watch the Fireship video. They explicitly disabled safety protections in SpiderMonkey. The exploit would never have worked on normal browsers.

Re: Has Mythos just broken the deal that kept the internet safe?

#65

Post by chjggjjvjjtoo » Fri, Apr 17, 2026, 3:21 AM UTC

Watch the Fireship video. They tested it on a Spidermonkey sandbox that had safety features disabled. The "exploits" are basically useless in real life.