3 ms·

And to think some said developers aren’t affected by marketing. The whole thing is a psyop - wow it’s so amazing we can’t give it to you. Meanwhile you can lit

And to think some said developers aren’t affected by marketing. The whole thing is a psyop - wow it’s so amazing we can’t give it to you. Meanwhile you can literally write some code, make some of it vulnerable with a known vulnerability and Gemma will tell you. You can go and try it now. There’s nothing mystique about it. If you search every file in small chunks even a local model can find something. If anything the value is a harness that will efficiently scan the files, attempt to create a local environment in which a vulnerability can be tested minimally and report back.

ceejayoz 6mo ago
> make some of it vulnerable with a known vulnerability and Gemma will tell you Well, yeah. Isn't the idea finding unknown vulnerabilities?
- amazingamazing 6mo ago
  Yes, but the point is that you can actually test what I am asserting right now. Can you use mythos and reproduce anthropics claims?
  - ceejayoz 6mo ago
    But I don't need to test that; we all know it's possible. Known vulnerabilities are in the training set! Mythos is being claimed to have new abilities, right? What would testing the old model on a different use case do?
    - amazingamazing 6mo ago
      You’re conflating types of vulnerabilities with the vulnerability itself. Take CVE-2026-4747 which was supposedly found by mythos. The actual issue here is a stack overflow. Opus can find those.
      - ceejayoz 6mo ago
        Why wasn't that one, then?
cvwright 6mo ago
It’s easy to find sketchy lines of code in any large C project. The big advance that they are claiming with Mythos is the ability to triage all the hundreds of candidate vulns and automatically generate exploits to prove that the real ones are real. And if they’re really finding 27-yr-old 0-days in OpenBSD, then it’s not just hype.
- amazingamazing 6mo ago
  I do not think you need a great model to do this, just great automation. There’s a reason they haven’t open sourced the actual process in which did this, stubbing out the mythos model itself.
  - klausa 6mo ago
    About five minutes in in this video: https://www.youtube.com/watch?v=1sd26pWhfmg https://www.youtube.com/watch?v=1sd26pWhfmg They also say publicly in their Opus 4.6 post (https://red.anthropic.com/2026/zero-days/ https://red.anthropic.com/2026/zero-days/): >In this work, we put Claude inside a “virtual machine” (literally, a simulated computer) with access to the latest versions of open source projects. We gave it standard utilities (e.g., the standard coreutils or Python) and vulnerability analysis tools (e.g., debuggers or fuzzers), but we didn’t provide any special instructions on how to use these tools, nor did we provide a custom harness that would have given it specialized knowledge about how to better find vulnerabilities. This means we were directly testing Claude’s “out-of-the-box” capabilities, relying solely on the fact that modern large language models are generally-capable agents that can already reason about how to best make use of the tools available.
    - amazingamazing 6mo ago
      Again, marketing materials by Anthropic. You realize this is by anthropic themselves right? And again, not reproducible by outsiders. So useless.
      - klausa 6mo ago
thrance 6mo ago
> The whole thing is a psyop - wow it’s so amazing we can’t give it to you. Anyone else still remembers when OpenAI refused to release GPT2-xl because it was "too powerful"?

ceejayoz 6mo ago

> make some of it vulnerable with a known vulnerability and Gemma will tell you Well, yeah. Isn't the idea finding unknown vulnerabilities?

amazingamazing 6mo ago
Yes, but the point is that you can actually test what I am asserting right now. Can you use mythos and reproduce anthropics claims?
- ceejayoz 6mo ago
  But I don't need to test that; we all know it's possible. Known vulnerabilities are in the training set! Mythos is being claimed to have new abilities, right? What would testing the old model on a different use case do?
  - amazingamazing 6mo ago
    You’re conflating types of vulnerabilities with the vulnerability itself. Take CVE-2026-4747 which was supposedly found by mythos. The actual issue here is a stack overflow. Opus can find those.
    - ceejayoz 6mo ago
      Why wasn't that one, then?

cvwright 6mo ago

It’s easy to find sketchy lines of code in any large C project. The big advance that they are claiming with Mythos is the ability to triage all the hundreds of candidate vulns and automatically generate exploits to prove that the real ones are real. And if they’re really finding 27-yr-old 0-days in OpenBSD, then it’s not just hype.

amazingamazing 6mo ago
I do not think you need a great model to do this, just great automation. There’s a reason they haven’t open sourced the actual process in which did this, stubbing out the mythos model itself.
- klausa 6mo ago
  About five minutes in in this video: https://www.youtube.com/watch?v=1sd26pWhfmg https://www.youtube.com/watch?v=1sd26pWhfmg They also say publicly in their Opus 4.6 post (https://red.anthropic.com/2026/zero-days/ https://red.anthropic.com/2026/zero-days/): >In this work, we put Claude inside a “virtual machine” (literally, a simulated computer) with access to the latest versions of open source projects. We gave it standard utilities (e.g., the standard coreutils or Python) and vulnerability analysis tools (e.g., debuggers or fuzzers), but we didn’t provide any special instructions on how to use these tools, nor did we provide a custom harness that would have given it specialized knowledge about how to better find vulnerabilities. This means we were directly testing Claude’s “out-of-the-box” capabilities, relying solely on the fact that modern large language models are generally-capable agents that can already reason about how to best make use of the tools available.
  - amazingamazing 6mo ago
    Again, marketing materials by Anthropic. You realize this is by anthropic themselves right? And again, not reproducible by outsiders. So useless.
    - klausa 6mo ago

thrance 6mo ago

> The whole thing is a psyop - wow it’s so amazing we can’t give it to you. Anyone else still remembers when OpenAI refused to release GPT2-xl because it was "too powerful"?