Project Glasswing: Securing critical software for the AI era • Hacker News Board

Re: Project Glasswing: Securing critical software for the AI era

#831

Post by jenniferhooley » Wed, Apr 08, 2026, 5:01 PM UTC

literalAardvark wrote: post #562

junon wrote: post #553

Earlier quoted context omitted.

> From where I'm sitting, I don't know a lot of developers that still artisanally code like they did a few years ago. You don't know a lot of developers then.

I do. The good ones use AI.

You are in a bubble. Some segments use essentially no AI, while others have gone all in. Just because the type of engineers you're surrounded by do engineering that is obsolete doesn't mean that's the case across the board. All the best game engineers I know still write at least 90% of the code (probably closer to 99%). The bad ones use AI nearly exclusively - just like yourself. They can't create very complex or performant game systems, and they struggle even with highly unique or interactive game UI systems. I've looked over their code; almost every choice is bad, and it's clear why their projects completely collapse after a certain point. They simply can't build super complex, performant, or novel systems.

I'm going to assume you do the type of engineering where all the hard problems are solved for you already, and you are merely connecting inputs/outputs and hooking up APIs. Because, frankly, the value in "software plumbing" is gone; anyone with a Claude license can do that now.

Re: Project Glasswing: Securing critical software for the AI era

#832

Post by scrollop » Wed, Apr 08, 2026, 5:08 PM UTC

mike_hearn wrote: post #748

tex0 wrote: post #533

Earlier quoted context omitted.

The interesting selling point about this, if the claims are substantial, is that nobody will be able to produce secure software without access to one of these models. Good for them $$$ ^^

Well, except that they're giving away a huge sum of compute to other big tech firms apparently for free?

No one said free.

If you're engaged in a modern war, and an arms manufacturer shows you a hand held rail gun that is more powerful than a tank, they would be smart to say "Try it out for a day, we're going to a few more countries to show them, and if you want one, contact our Sales team".

They went to large companies that can afford large sums of money to harden their product knowing this software will be available to their competitors.

Re: Project Glasswing: Securing critical software for the AI era

#833

Post by hhh » Wed, Apr 08, 2026, 5:13 PM UTC

powvans wrote: post #784

IMTDb wrote: post #773

Earlier quoted context omitted.

You can already do that today by hiring a security researcher. I can guarantee you that Apple has access to people of a higher caliber than my startup. I could see a world where 1 year from now I can have glassing do a full sweep of my codebase for a given price (say: $10k). Running that once a year is within my means and would make my software much more secure than it is today.

I spend well over that of my employers money on pentesting every year. I’m absolutely certain Claude could perform as good or better a job using what’s available today. It had crossed my mind that an AI agent pentester would be an interesting product to build. Once again though, the labs are just going to build it because it’s a thin thin wrapper. Beyond existing software with vulnerabilities, the really important as…

AWS has one as a managed service.

Re: Project Glasswing: Securing critical software for the AI era

#834

Post by SpicyLemonZest » Wed, Apr 08, 2026, 5:15 PM UTC

0123456789ABCDE wrote: post #830

SpicyLemonZest wrote: post #511

Earlier quoted context omitted.

If I understand Anthropic's statements correctly, they've been cranking for a while, and what they have now is the results of Mythos-enabled vulnerability scans on every important piece of software they could find. (I do want to acknowledge how crazy it is that "vulnerability scan all important software repos in the world" is even an operation that can be performed.)

which statement, specifically, led you to interpret this claim?

> Over the past few weeks, we have used Claude Mythos Preview to identify thousands of zero-day vulnerabilities (that is, flaws that were previously unknown to the software’s developers), many of them critical, in every major operating system and every major web browser, along with a range of other important pieces of software.

They don’t explicitly rule out, I suppose, that these were only limited partial scans they did to find the vulnerabilities. But I don’t know why they’d do it that way, it’s not like they don’t have the resources to scan the entire Linux kernel.

Re: Project Glasswing: Securing critical software for the AI era

#835

Post by ghaff » Wed, Apr 08, 2026, 5:15 PM UTC

kashyapc wrote: post #601

qnleigh wrote: post #526

Earlier quoted context omitted.

There is plenty of overhyping, no one denies that. But the antidote is not to dismiss everything. Ignore the words and look at the data. In this case, I see a pretty strong case that this will significantly change computer security. They provide plenty of evidence that the models can create exploits autonomously, meaning that the cost of finding valuable security breaches will plummet once they're widely available.

You seem to see a "pretty strong case" from a bombastic press release. Don't get me wrong, I do know the reality has changed. Even Greg K-H, the Linux stable maintainer, did recently note[1] that it's not funny any more: "Months ago, we were getting what we called 'AI slop,' AI-generated security reports that were obviously wrong or low quality," he said. "It was kind of funny. It didn't really worry us." ... "Someth…

Hadn’t been to a Kubecon in about a year as I’ve been tending to go to just the European ones. I definitely felt a much stronger this is real vibe at this event from people like Greg KH.

Re: Project Glasswing: Securing critical software for the AI era

#836

Post by 6thbit » Wed, Apr 08, 2026, 5:15 PM UTC

burntcaramel wrote: post #716

Previously Anthropic subscribers got access to the latest AI but it seems like there’s a League of Software forming who have special privileges. To make or maintain critical software will you have to be inside the circle? Who gates access to the circle? Anthropic or existing circle members or some other governance? If you are outside the circle will you be certain to die from software diseases? Having been impressed…

It's only a moat if you believe no competing lab will achieve similar or better results in a large enough time frame to profit from it.

Re: Project Glasswing: Securing critical software for the AI era

#837

Post by waffletower » Wed, Apr 08, 2026, 5:18 PM UTC

My comment is a completely unsubstantiated conspiracy theory: the choice of model name, Mythos, seems out of character for Anthropic models, and one can easily wonder if the model truly exists as the name suggests. It could instead be a symbolic model used by colluding companies (and perhaps even governments) to establish a reference limit upon what models will be publicly accessible, period. Probably a terrible theory as it could spell doom for frontier model developing companies' business models -- setting the bar already would likely commodify LLMs via open source models quite quickly. But the name "Mythos" is such a strange choice for this model and the circumstances surrounding its release.

Re: Project Glasswing: Securing critical software for the AI era

#838

Post by 6thbit » Wed, Apr 08, 2026, 5:19 PM UTC

ainch wrote: post #352

redfloatplane wrote: post #13

The system card for Claude Mythos (PDF): https://www-cdn.anthropic.com/53566bf5440a10affd749724787c89... Interesting to see that they will not be releasing Mythos generally. [edit: Mythos Preview generally - fair to say they may release a similar model but not this exact one] I'm still reading the system card but here's a little highlight: > Early indications in the training of Claude Mythos Preview suggested that th…

This opens up an interesting new avenue for corporate FOMO. What if you don't partner with Anthropic, miss out on access to their shiny new cybersec model, and then fall prey to a vuln that the model would have caught?

This seems to be the mind-games play. FOMO at the moment, if they push it successfully you could even be labeled negligent for not paying them for it.

Re: Project Glasswing: Securing critical software for the AI era

#839

Post by 0123456789ABCDE » Wed, Apr 08, 2026, 5:27 PM UTC

josephg wrote: post #560

tptacek wrote: post #510

Earlier quoted context omitted.

Again: LLM agents already are both . But it's also remarkable and worth digging into the fact that LLM agents haven't needed fuzzers to produce many (any? in Anthropic Red's case?) of the vulnerabilities they're discussing.

Do we know that? I'd love to see some of the ways security researchers are using LLMs. We have no idea if claude was using fuzzing here, or just reading the files and spotting bugs directly in the source code. A few weeks ago someone talked about their method for finding bugs in linux. They prompted claude with "Find the security bug in this program. Hint: It is probably in file X.". And they did that for every file…

> Since then, this weakness has been missed by every fuzzer and human who has reviewed the code, and points to the qualitative difference that advanced language models provide. [^1]

> At no point in time does the program take some easy-to-identify action that should be prohibited, and so tools like fuzzers can’t easily identify such weaknesses. [^2]

[^1]: https://red.anthropic.com/2026/mythos-preview/#:~:text=Since...

[^2]: https://red.anthropic.com/2026/mythos-preview/#:~:text=At%20...

Re: Project Glasswing: Securing critical software for the AI era

#840

Post by charcircuit » Wed, Apr 08, 2026, 5:30 PM UTC

solenoid0937 wrote: post #521

charcircuit wrote: post #317

Earlier quoted context omitted.

Risk for who? It feels unfair that the risk to myself is ignored "for the greater good of everyone else."

Welcome to the world of security engineering, in which your needs do not in fact trump the needs of everyone else.

It's not just me against the world. It's users of big tech vs everyone else. Will my browser get these security patches? Or will only Chrome get them and everyone else gets to be vulnerable because that would endanger users of big tech.