I’ve had a bunch of people ask my thoughts on Anthropic’s Mythos.
-
I was under the impression that the open source projects they communicated their findings with have confirmed them?
Stringing together exploits and ROP-chains is what had me take it seriously. It's not that we can't do that as well, it's being able to automate it at scale that's worrying.
(And that's not a worry about _Mythos_ - we know the open models lag ~1 year behind the cloud models so these capabilities can be expected to be at nation state actors about now and with "everyone" in a year)
@troed @GossiTheDog @malwaretech Everything they actually sent out went through competent human professionals that were well compensated, they prove nothing.
-
Companion video https://youtu.be/fM7GIIylXqI
@GossiTheDog
Hello, I'm Ibrahim from Gaza. I have Down syndrome and anemia. Please help me. Even small donations make a difference. Please share this pinned post to spread the word. -
R relay@relay.an.exchange shared this topic
-
I’ve had a bunch of people ask my thoughts on Anthropic’s Mythos. I’ve read the research paper they released and the numbers, and basically I agree with @malwaretech’s take. It’s marketing. The cybersecurity industry is historically very good at marketing cyber pearl harbour and the need to buy magic boxes.
@GossiTheDog @malwaretech @steltenpower Well, well, well. Our old friends Fear, Uncertainty and Doubt
-
Companion video https://youtu.be/fM7GIIylXqI
I don't think anybody actually watches videos any more, so here's MWT's core point -
The flagship and lead vuln in the research is a BSD vuln, it cost $20k to discover with Mythos. Anthropic only reached a crash, and the vuln class in 99%+ cases never reaches RCE, just crashes.
So.. cool.. you spent $20k of VC money to find a crash as the flagship vuln. But... uhm... that isn't the end of the world.
The proof is going to be if any of the open source vulns turn out to be important. So far:
-
I don't think anybody actually watches videos any more, so here's MWT's core point -
The flagship and lead vuln in the research is a BSD vuln, it cost $20k to discover with Mythos. Anthropic only reached a crash, and the vuln class in 99%+ cases never reaches RCE, just crashes.
So.. cool.. you spent $20k of VC money to find a crash as the flagship vuln. But... uhm... that isn't the end of the world.
The proof is going to be if any of the open source vulns turn out to be important. So far:
Anthropic set the project across open source projects and provided access and reported the vulns. Typically, you'd expect to see NCSCs spinning up advisories to patch high impact vulns, CISA telling orgs to patch etc etc etc.
What's actually happening is... uhm... a whole heap of nothing but people copy and pasting marketing about how cybersecurity is over.
It's not though, is it?
-
Anthropic set the project across open source projects and provided access and reported the vulns. Typically, you'd expect to see NCSCs spinning up advisories to patch high impact vulns, CISA telling orgs to patch etc etc etc.
What's actually happening is... uhm... a whole heap of nothing but people copy and pasting marketing about how cybersecurity is over.
It's not though, is it?
Well cybersecurity is over but not because of this but because of everyone and their mother deploying openclaw in production...
-
I don't think anybody actually watches videos any more, so here's MWT's core point -
The flagship and lead vuln in the research is a BSD vuln, it cost $20k to discover with Mythos. Anthropic only reached a crash, and the vuln class in 99%+ cases never reaches RCE, just crashes.
So.. cool.. you spent $20k of VC money to find a crash as the flagship vuln. But... uhm... that isn't the end of the world.
The proof is going to be if any of the open source vulns turn out to be important. So far:
@GossiTheDog from a practical perspective what worries me more is time to poc/working exploit for known vulns.
OSS library releases patch, model looks at diff + cve description and drops a working exploit for a couple of hundred $ of compute.
Most companies (at least this side of the pond) are not currently equipped to deal with continuously applying patches for 1-day vulns in prod.
Many large orgs here are proud that they've managed to get on a monthly update cycle -
I’ve had a bunch of people ask my thoughts on Anthropic’s Mythos. I’ve read the research paper they released and the numbers, and basically I agree with @malwaretech’s take. It’s marketing. The cybersecurity industry is historically very good at marketing cyber pearl harbour and the need to buy magic boxes.
@GossiTheDog @malwaretech The number of people who should know better just going "*this time* the PR blather is true, I just know it!" is pretty cringe.
-
Anthropic set the project across open source projects and provided access and reported the vulns. Typically, you'd expect to see NCSCs spinning up advisories to patch high impact vulns, CISA telling orgs to patch etc etc etc.
What's actually happening is... uhm... a whole heap of nothing but people copy and pasting marketing about how cybersecurity is over.
It's not though, is it?
@GossiTheDog Haven't we already been there with fuzzing?
Anyway, even if Mythos is as good as they claim, that's not really a problem as long as it is available only to a few. It's when every script kiddie gets access to it that we should start worrying.
-
@GossiTheDog from a practical perspective what worries me more is time to poc/working exploit for known vulns.
OSS library releases patch, model looks at diff + cve description and drops a working exploit for a couple of hundred $ of compute.
Most companies (at least this side of the pond) are not currently equipped to deal with continuously applying patches for 1-day vulns in prod.
Many large orgs here are proud that they've managed to get on a monthly update cycle@GossiTheDog to be fair, the current time to poc is in many cases already down ≤ 1 day or so, but this could take some of the skill out of it and make it more broadly available
-
Well cybersecurity is over but not because of this but because of everyone and their mother deploying openclaw in production...
@agowa338 Cyber security is an insanely complex beast with some parts being technical, some being human, some being regulatory, etc., and well, finding bugs is one small component.
Emphasis on small.
We have not really been great at cyber security in the past, and improvements are needed all across the board. We won't be great at it tomorrow because magic.
Having one component potentially improve is, especially given how speculative the current situation is, is nothing to really worry about. Rather the contrary.
Time will tell, some processes might change, and that is likely all that will happen for a long time.
Most humans in cyber security will very likely notice very little impact for now. Can this all go sideways? Yes, of course. Is it time to say that cyber security is over? I don't think so. At all.
-
@GossiTheDog to be fair, the current time to poc is in many cases already down ≤ 1 day or so, but this could take some of the skill out of it and make it more broadly available
@GossiTheDog but other than that... yeah hype-marketing playbook 101.
Didn't OpenAI pull the:"oh no it's too powerful, humanity couldn't take it yet so we're not releasing it to the public", stunt with one of their earlier models as well?^^
-
@agowa338 Cyber security is an insanely complex beast with some parts being technical, some being human, some being regulatory, etc., and well, finding bugs is one small component.
Emphasis on small.
We have not really been great at cyber security in the past, and improvements are needed all across the board. We won't be great at it tomorrow because magic.
Having one component potentially improve is, especially given how speculative the current situation is, is nothing to really worry about. Rather the contrary.
Time will tell, some processes might change, and that is likely all that will happen for a long time.
Most humans in cyber security will very likely notice very little impact for now. Can this all go sideways? Yes, of course. Is it time to say that cyber security is over? I don't think so. At all.
I know. I've been done that. I was the only technician that talked to the compliance people so I "earned" all of the work involved in communicating and bridging both worlds.
And since then it just got worse. Nobody cares about it security. The compliance people are just writing some shit and at this point in many companies they don't even expect their technicians to actually implement it anymore either (if it is even possible at all).
It's just a work creation measure at this point…
-
@GossiTheDog Haven't we already been there with fuzzing?
Anyway, even if Mythos is as good as they claim, that's not really a problem as long as it is available only to a few. It's when every script kiddie gets access to it that we should start worrying.
@bontchev @GossiTheDog Agreed. Current recommendation from our end:
Keep calm, find and fix bugs, make the world a bit safer one bug at a time...
And ignore the hype train, but keep an open eye on how real and measurable things develop. Just what we did before.
-
I don't think anybody actually watches videos any more, so here's MWT's core point -
The flagship and lead vuln in the research is a BSD vuln, it cost $20k to discover with Mythos. Anthropic only reached a crash, and the vuln class in 99%+ cases never reaches RCE, just crashes.
So.. cool.. you spent $20k of VC money to find a crash as the flagship vuln. But... uhm... that isn't the end of the world.
The proof is going to be if any of the open source vulns turn out to be important. So far:
@GossiTheDog he makes a good point about the subsidized cost. It's like in the early days when Uber was cheap AF to put the taxis out of business. Once they had market share, they cost as much as taxis.
-
Anthropic set the project across open source projects and provided access and reported the vulns. Typically, you'd expect to see NCSCs spinning up advisories to patch high impact vulns, CISA telling orgs to patch etc etc etc.
What's actually happening is... uhm... a whole heap of nothing but people copy and pasting marketing about how cybersecurity is over.
It's not though, is it?
@GossiTheDog They aren't claiming it's over, that's a strawman. But interestingly they are providing commit hashes of things they've found. Some of these are seriously scary. I've saved a copy of the webpage and will be waiting to see if the promised commits turn up. If they do check out my opinion of Anthropic will rise. If not...
-
I don't think anybody actually watches videos any more, so here's MWT's core point -
The flagship and lead vuln in the research is a BSD vuln, it cost $20k to discover with Mythos. Anthropic only reached a crash, and the vuln class in 99%+ cases never reaches RCE, just crashes.
So.. cool.. you spent $20k of VC money to find a crash as the flagship vuln. But... uhm... that isn't the end of the world.
The proof is going to be if any of the open source vulns turn out to be important. So far:
Yes, we do watch videos!
-
I don't think anybody actually watches videos any more, so here's MWT's core point -
The flagship and lead vuln in the research is a BSD vuln, it cost $20k to discover with Mythos. Anthropic only reached a crash, and the vuln class in 99%+ cases never reaches RCE, just crashes.
So.. cool.. you spent $20k of VC money to find a crash as the flagship vuln. But... uhm... that isn't the end of the world.
The proof is going to be if any of the open source vulns turn out to be important. So far:
I asked the FreeBSD security officer to compare the (not yet public) one to Coverity reports. Apparently it found something that Coverity didn't, which means at least it isn't just regurgitating static analyser reports.
That said, last time I read the Coverity reports, they found tens of thousands of possible issues (over 90% of the ones I triaged were false positives). You could probably get a higher RoI from paying someone $20K to triage Coverity scan reports.
-
I’ve had a bunch of people ask my thoughts on Anthropic’s Mythos. I’ve read the research paper they released and the numbers, and basically I agree with @malwaretech’s take. It’s marketing. The cybersecurity industry is historically very good at marketing cyber pearl harbour and the need to buy magic boxes.
@GossiTheDog @malwaretech Agree, and I will only add one thing: Misanthropic is an amoral cult.
-
I’ve had a bunch of people ask my thoughts on Anthropic’s Mythos. I’ve read the research paper they released and the numbers, and basically I agree with @malwaretech’s take. It’s marketing. The cybersecurity industry is historically very good at marketing cyber pearl harbour and the need to buy magic boxes.
Yeah and solutions like this dont put servers in datacenters or work with threat analysis on transit traffic.
If all its doing is improving point software solutions, then thats a good thing. Its not going to finish off SAAS solutions - its going to improve them.
