I’ve had a bunch of people ask my thoughts on Anthropic’s Mythos.

[david_chisnall@infosec.exchange]

@GossiTheDog

I asked the FreeBSD security officer to compare the (not yet public) one to Coverity reports. Apparently it found something that Coverity didn't, which means at least it isn't just regurgitating static analyser reports.

That said, last time I read the Coverity reports, they found tens of thousands of possible issues (over 90% of the ones I triaged were false positives). You could probably get a higher RoI from paying someone $20K to triage Coverity scan reports.

[codinghorror@infosec.exchange]

@GossiTheDog @malwaretech Agree, and I will only add one thing: Misanthropic is an amoral cult.

[cresssalad@mastodon.social]

@GossiTheDog @malwaretech

Yeah and solutions like this dont put servers in datacenters or work with threat analysis on transit traffic.

If all its doing is improving point software solutions, then thats a good thing. Its not going to finish off SAAS solutions - its going to improve them.

[sikorsky78@infosec.exchange]

@GossiTheDog Thanks for the summary, ain't got time for viewing videos.

[evoscale@c.im]

@GossiTheDog @malwaretech Be wary of projecting special interests, couched in pure Capitalist profiting, too far among a valuable sector like CyberSec. It's a common pattern for a narrowing margin of the masses, to control more vital infrastructure, and heap residual abuses (thanks Capitalism) upon the far more innocent.

[coffe@social.piewpiew.se]

@GossiTheDog I still do XD

[doragasu@mastodon.sdf.org]

@GossiTheDog @malwaretech Other researchers have replicated their try at finding security bugs with publicly available models and got same results. Is it better than earlier models? I suppose it is, it would be a big failure if a new bigger model wasn't. Is it the big leap they state. Doubtful.

[aristot73@infosec.exchange]

@GossiTheDog @malwaretech i found this post very relevant
https://mastodon.social/@CuratedHackerNews/116387186190988598

[ralph@hear-me.social]

@GossiTheDog @malwaretech

#alttext

Marcus Hutchins
Malware, Threat Intelligence, Ex-Hacker
Since multiple people have asked me to comment on Claude Mythos / Glasswing, here it is: I can't possibly comment on something I haven't even seen, let alone used.
I, like everyone issuing hot takes, have absolutely no information to go off. We're all looking at the same marketing post with scant falsifiable data or testable hypotheses.
People need to stop clapping like a herd of trained seals every time a corporation drops a new press release. Why not wait for actual impartial data and empirical evidence, then evaluate accordingly?
Press Releases are designed to make a product look as good as possible (and in many cases much better than it actually is, see: Devin, GPT-5, Humane Al, Sora, etc). These are marketing publications not peer-reviewed articles in scientific journals.
We really, as an industry, need to start being more objective. I get that everyone is excited for Al, but we don't need 200,000 hot takes about how "cybersecurity is over" or "the world is ending" every time a new press release drops.
Marketing teams get paid lots of money to hype up new products. Why are you doing their work for free?

[j2kun@mathstodon.xyz]

@GossiTheDog IMO it's not nothing but not apocalypse. Enough for forward thinking groups to start taking it seriously and considering risks.

[marius@kiessling.social]

@GossiTheDog Even *if* the word prediction box is now capable of findings vulns by throwing massive compute at the problem (leaving all the problems with this aside), you still need to get people to fix their shit. Like have they ever looked at what it takes to get a company to just patch their god damn network edge devices?

[loadhigh@bitbang.social]

@GossiTheDog @malwaretech I, too, had my a-technical and very pro-A"I" colleague singing Mythos' praises. When I pointed out that we don't know how many false positives it also produced, it did dawn on him that it might not all that it seems

The thing is, is that he is in marketing, so he should know he's being fed a crafted story. But when it comes to this LLM-craze all critical thinking goed overboard, it seems.

I'm so worried about the future.

[samiamsam@mastodon.social]

@GossiTheDog @malwaretech

i keep thinking of the pet rock

and beanie babies

create buzz, create demand, get out early, everyone else is left with useless stuff cluttering their homes

[rhempel@cosocial.ca]

@GossiTheDog @malwaretech Someday we will have a TV show called "Mythos Busters" where real cyber security experts debunk stuff like this ...

[npars01@mstdn.social]

@marius @GossiTheDog

In my observation, organizations use these PR announcements & media releases to do layoffs, so they can outsource to a nephew's startup or grandchild's consultancy.

And the necessary patches or policy changes never get implemented.

[dalias@hachyderm.io]

@trademark @GossiTheDog What does "commit hashes of things they've found" even mean? No non-slop project is going to merge the same commits they used in their fixes, because they're LLM slop without provenance to license. If any of these are real, the upstream will fix the bug properly in a way the actual people working on the project understand and can document.

[marius@kiessling.social]

@Npars01 from experience, we can even leave out the nepotism and just trace it back to incompetence within the management team

[nyanbinary@infosec.exchange]

@GossiTheDog the thing I find the funniest is that their headline vulnerability in OpenBSD was closed as a reliability, not security issue & without a CVE, as far as I can tell?

[lhbm@mastodon.social]

@bontchev @GossiTheDog if it really did burn $20k in tokens to find the vuln, those script kiddies would have to be very well funded.

[azonenberg@ioc.exchange]

@dalias @trademark @GossiTheDog the hashes are of advisories they claim they will publish in the future afaik, not patches.