Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Glasswing: Securing critical software for the AI era

anthropic.com

Post reply on HN
Print view View original

801–810 of 921 posts

Re: Project Glasswing: Securing critical software for the AI era

#801

Post by ai5iq »

_pdp_ wrote: post #142
redfloatplane wrote: post #13

The system card for Claude Mythos (PDF): https://www-cdn.anthropic.com/53566bf5440a10affd749724787c89... Interesting to see that they will not be releasing Mythos generally. [edit: Mythos Preview generally - fair to say they may release a similar model but not this exact one] I'm still reading the system card but here's a little highlight: > Early indications in the training of Claude Mythos Preview suggested that th…

If it is that dangerous as they make it appear to be, 24h does not seem sufficient time. I cannot accept this as a serious attempt.

Agreed. I've been running autonomous LLM agents on daily schedules for weeks. The failure modes you worry about on day one are completely different from what actually shows up after the agents have history and context. 24 hours captures the obvious stuff.

Re: Project Glasswing: Securing critical software for the AI era

#802

Post by radicality »

pertymcpert wrote: post #457
radicality wrote: post #409

Earlier quoted context omitted.

Huh, I don’t know what “long context performance” means exactly in these tests, so completely anecdotally , my experience with gpt5.4 via codex cli vs Claude code opus, gpt5.4 seems to do significantly better in long contexts I think partly due to some special context compaction stored in encrypted blobs. On long conversations opus in Claude code will for me lose memory of what we were working on earlier, whereas one…

This isn’t talking about compaction. This refers to performance as the model is loaded with 500k to 1m tokens.

Ah, thanks, makes sense, I’ll read more about this

Re: Project Glasswing: Securing critical software for the AI era

#803

Post by ofjcihen »

mlsu wrote: post #792
KronisLV wrote: post #675

Earlier quoted context omitted.

> Every time I mention this I feel like there’s a bunch of factors for why it will never be the same for many folks, from the models and harnesses, to the domains and existing tests/tooling. I feel bad for the people for whom it doesn’t work, but Claude Opus has written most of my code in 2026 so far. I had to build some tools around linting entire projects and most of my tokens are probably referencing existing stuf…

It’s because the models response is conditioned on the prompt. They are as intelligent as the person using them In some sense it’s a lot like a google search. There’s this big box of knowledge and you are choosing tokens to pluck out of it. The quality of the tokens depends on how intelligent you are.

Don’t forget, it also depends on the complexity of the work and the experiences of the operator.

The less complex the work and the less experienced the operator means more perceived “wow” factor :)

There’s definitely an aspect of how you use it though. In my work it’s mostly been chaining to reduce non-determinism.

Re: Project Glasswing: Securing critical software for the AI era

#804

Post by StrauXX »

powvans wrote: post #784
IMTDb wrote: post #773

Earlier quoted context omitted.

You can already do that today by hiring a security researcher. I can guarantee you that Apple has access to people of a higher caliber than my startup. I could see a world where 1 year from now I can have glassing do a full sweep of my codebase for a given price (say: $10k). Running that once a year is within my means and would make my software much more secure than it is today.

I spend well over that of my employers money on pentesting every year. I’m absolutely certain Claude could perform as good or better a job using what’s available today. It had crossed my mind that an AI agent pentester would be an interesting product to build. Once again though, the labs are just going to build it because it’s a thin thin wrapper. Beyond existing software with vulnerabilities, the really important as…

There are quite a few such startups already out there. Results are mixed so far. Though I believe they get much better over the coming months and years.

Re: Project Glasswing: Securing critical software for the AI era

#805

Post by SpicyLemonZest »

Toutouxc wrote: post #795
SpicyLemonZest wrote: post #337

Earlier quoted context omitted.

I'm surprised to hear that. One of us is in a bubble, and I'm genuinely not sure who. I have not met anyone in tech (including multiple people at Google) who does still write code. I've been recreationally interested in AI for a long time, which is a potential source of skew I suppose, but I do not and most people in my circles do not work on anything directly related to AI.

Statistically, knowing multiple people at Google is, IMO, a pretty good sign you're in a bubble. Unless you know a few thousand other software developers.

An entirely fair point that I really ought to keep in mind more often. Thanks for keeping me honest.

Re: Project Glasswing: Securing critical software for the AI era

#807

Post by ofjcihen »

alexey-salmin wrote: post #620
ofjcihen wrote: post #508

I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. I would honestly go so far as to say the overhype is detrimental to actual measured adoption.

I think Claude Code with Sonnet 4.6 is already at the level of paradigm shift and can change the entire tech industry. If you're paranoid it doesn't mean you're not being followed. If something is overhyped it doesn't mean it's not game-changing.

Oh I agree with you on that. But that’s partially why the language in the presser falls flat for me.

I mean as an example while web app pen testing I’ve been running and proxying all my traffic through it with instructions to find vulnerabilities with instructions telling it it’s a senior web app security export looking over my shoulder. It’s already great at that.

Ive even told it to do recon and run pen tests on lists of subdomains before (please for the love of god have the right harnesses and guardrails before you do this) and woken up to paid findings before.

So like I’m in a weird place where this was already happening and Mythos is being sold like it wasn’t good before?

End ramble :/

Re: Project Glasswing: Securing critical software for the AI era

#808

Post by ofjcihen »

_the_inflator wrote: post #649
ofjcihen wrote: post #508

I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. I would honestly go so far as to say the overhype is detrimental to actual measured adoption.

I side with you but on the other hand: this is how it works to get attention by those who aren't affiliated with computer science and AI. I am totally annoyed as well and put any buzzwords in my personal bs filter. Java was revolutionary, the Apple I etc. ;) On the other hand I see progress! AI enriched press releases balance buzzwords and information way better than marketing of large companies did before AI. I reme…

Hahaha I think we might have the same toothbrush.

That makes sense and I like the analogy.

Re: Project Glasswing: Securing critical software for the AI era

#809

Post by solenoid0937 »

kortilla wrote: post #574
solenoid0937 wrote: post #527

Earlier quoted context omitted.

I don't know how you can read the report and the companies involved and dismiss this as hot air. What incentive does the Linux Foundation have to hype up Mythos? What about Apple? How can you read the description of the exploits and be like "yeah that's nbd?" And the only reason OSS has ever caught up is because they simply distill Claude or GPT. The day the big players make it hard to distill (like Anthropic is doin…

No, that’s a terrible thing and random skiddie hackers absolutely should. This is only a temporary state of insecurity as these vulnerability scanners come online. If this stuff is open source and not gate kept, it will be standard practice to just run some LLM security analysis on every commit and software will no longer be vulnerable to these classes of attacks.

Your "just a temporary state of insecurity" results in literal dead bodies on the ground unless defenders have a chance to front-run.

Re: Project Glasswing: Securing critical software for the AI era

#810

Post by solenoid0937 »

Overpower0416 wrote: post #642
solenoid0937 wrote: post #532

Earlier quoted context omitted.

If you aren't relying on a SOTA model to do your job, you aren't doing your job right (and are cooked.)

Did a LLM tell you that?

common sense and interviewing around did. no one wants to hire someone that is not AI native anymore, unless you are looking at positions that pay peanuts
Post reply on HN