4 ms·

Anakin: I'm going to save the world with my AI vulnerability scanner, Padme. Padme: You're scanning for vulnerabilities so you can fix them, Anakin? Anakin: .

by upghost 8mo ago

Anakin: I'm going to save the world with my AI vulnerability scanner, Padme. Padme: You're scanning for vulnerabilities so you can fix them, Anakin? Anakin: ... Padme: You're scanning for vulnerabilities so you can FIX THEM, right, Annie?

czbond 8mo ago
Definitely will be a fight against bad actors pulling bulk open source software projects, npm packages, etc and running this for their own 0 days. I hope Anthropic can place alerts for their team to look for accounts with abnormal usage pre-emptively.
- tptacek 8mo ago
  You want frontier models to actively prevent people from using them to do vulnerability research because you're worried bad people will do vulnerability research?
  - czbond 8mo ago
    Not at all. I was suggesting if an account is performing source code level request scanning of "numerous" codebases - that it could be an account of interest. A sign of mis-use. This is different than someones "npm audit" suggesting issues with packages in a build and updating to new revisions. Also different than iterating deeply on source code for a project (eg: nginx web server).
- deleted 8mo ago
  [deleted]
tptacek 8mo ago
I don't understand the joke here.
- john_strinlai 8mo ago
  [dead]
- ukuina 8mo ago
  A vuln scanner is dual-use.
- RupertSalt 8mo ago
  It's an Internet trope — we could link to knowyourmeme, or link to the HN Guidelines
nikcub 8mo ago
I assume that's why this is gated behind a request for access from teams / enterprise users rather than being GA but there are open versions available built on the cn OSS models: https://github.com/lintsinghua/DeepAudit https://github.com/lintsinghua/DeepAudit
- sciencejerk 8mo ago
  The GA functionality is already here with a crafted prompt or jailbreak :)
  - nikcub 8mo ago
    it's gone a bit unnoticed that they've stopped support for response prefilling in the 4.6 models :/
SerCe 8mo ago
What's incredibly ironic is that research labs are releasing the most advanced hacking toolkit ever known, and cybersecurity defence stocks are going down as a result somehow. There’s no logic in the stock markets.

by upghost 8mo ago

czbond 8mo ago

Definitely will be a fight against bad actors pulling bulk open source software projects, npm packages, etc and running this for their own 0 days. I hope Anthropic can place alerts for their team to look for accounts with abnormal usage pre-emptively.

tptacek 8mo ago
You want frontier models to actively prevent people from using them to do vulnerability research because you're worried bad people will do vulnerability research?
- czbond 8mo ago
  Not at all. I was suggesting if an account is performing source code level request scanning of "numerous" codebases - that it could be an account of interest. A sign of mis-use. This is different than someones "npm audit" suggesting issues with packages in a build and updating to new revisions. Also different than iterating deeply on source code for a project (eg: nginx web server).
deleted 8mo ago
[deleted]

tptacek 8mo ago

I don't understand the joke here.

john_strinlai 8mo ago
[dead]
ukuina 8mo ago
A vuln scanner is dual-use.
RupertSalt 8mo ago
It's an Internet trope — we could link to knowyourmeme, or link to the HN Guidelines

nikcub 8mo ago

I assume that's why this is gated behind a request for access from teams / enterprise users rather than being GA but there are open versions available built on the cn OSS models: https://github.com/lintsinghua/DeepAudit https://github.com/lintsinghua/DeepAudit

sciencejerk 8mo ago
The GA functionality is already here with a crafted prompt or jailbreak :)
- nikcub 8mo ago
  it's gone a bit unnoticed that they've stopped support for response prefilling in the 4.6 models :/

SerCe 8mo ago

What's incredibly ironic is that research labs are releasing the most advanced hacking toolkit ever known, and cybersecurity defence stocks are going down as a result somehow. There’s no logic in the stock markets.