3 ms·

Anthropic has not in fact released it, and it does in fact appear to be that dangerous, judging by the flood of vulnerability reports seen by e.g. Daniel Stenbe

Anthropic has not in fact released it, and it does in fact appear to be that dangerous, judging by the flood of vulnerability reports seen by e.g. Daniel Stenberg. Certainly it’s a strategy OpenAI has used before, and when they did so it was a lie. Altman’s dishonesty does not mean it can never be true, however.

embedding-shape 6mo ago
> judging by the flood of vulnerability reports seen by e.g. Daniel Stenberg Maybe I've missed anything, but what Stenberg been complaining about so far been the wave of sloppy reports, seemingly reported by/mainly by AIs. Has that ratio somehow changed recently to mainly be good reports with real vulnerabilities?
- depr 6mo ago
  Yes: > The challenge with AI in open source security has transitioned from an AI slop tsunami into more of a ... plain security report tsunami. Less slop but lots of reports. Many of them really good. > I'm spending hours per day on this now. It's intense. https://mastodon.social/@bagder/116336957584445742 https://mastodon.social/@bagder/116336957584445742
- StrauXX 6mo ago
  He has changed his opinion completely. Yes, the ratio has turned.
- rhdunn 6mo ago
  Some relevant links: [1] https://www.npr.org/2026/04/11/nx-s1-5778508/anthropic-project-glasswing-ai-cybersecurity-mythos-preview https://www.npr.org/2026/04/11/nx-s1-5778508/anthropic-proje... > Improvement in AI models' capabilities became noticeable early 2026, said Daniel Stenberg. > He estimates that about 1 in 10 of the reports are security vulnerabilities, the rest are mostly real bugs. Just three months into 2026, the cURL team Stenberg leads has found and fixed more vulnerabilities than each of the previous two years. [2] https://www.linkedin.com/posts/danielstenberg_curl-activity-7450451335860117504-SM48 https://www.linkedin.com/posts/danielstenberg_curl-activity-... > The new #curl, AI, security reality shown with some graphs. Part of my work-in-progress presentation at foss-north on April 28.
amarcheschi 6mo ago
How many months till they release a better model than mythos to general audience? Gpt 2 wasn't released fully because OpenAI deemed it too dangerous, rings a bell? https://openai.com/index/better-language-models/#sample1 https://openai.com/index/better-language-models/#sample1
- Hizonner 6mo ago
  A few months of restricting access to people they think will actually fix problems is a big deal. Obviously only an idiot would think it could or should be kept under wraps forever.
deleted 6mo ago
[deleted]
kordlessagain 6mo ago
Those vulnerabilities were found by open models as well.
- mccr8 6mo ago
  Not really. The models were pointed specifically at the location of the vulnerability and given some extra guidance. That's an easier problem than simply being pointed at the entire code base.
  - 0cf8612b2e1e 6mo ago
    Surely the Anthropic model also only looked at one chunk of code at a time. Cannot fit the entire code base into context. So supplying an identical chunk size (per file, function, whatever) and seeing if the open source model can find anything seems fair. Deliberately prompting with the problem is not.
- abustamam 6mo ago
  Partly true. I think the consensus was it wasn't comparable because Mythos swept the entire codebase and found the vulnerabilities, whereas the open models were told where to look for said vulnerabilities. https://news.ycombinator.com/item?id=47732337 https://news.ycombinator.com/item?id=47732337
mccr8 6mo ago
The flood of reports that open source projects like curl, Linux and Chromium are getting are presumably due to public models like Open 4.6 that released earlier this year, and not models with limited availability.

embedding-shape 6mo ago

> judging by the flood of vulnerability reports seen by e.g. Daniel Stenberg Maybe I've missed anything, but what Stenberg been complaining about so far been the wave of sloppy reports, seemingly reported by/mainly by AIs. Has that ratio somehow changed recently to mainly be good reports with real vulnerabilities?

depr 6mo ago
Yes: > The challenge with AI in open source security has transitioned from an AI slop tsunami into more of a ... plain security report tsunami. Less slop but lots of reports. Many of them really good. > I'm spending hours per day on this now. It's intense. https://mastodon.social/@bagder/116336957584445742 https://mastodon.social/@bagder/116336957584445742
StrauXX 6mo ago
He has changed his opinion completely. Yes, the ratio has turned.
rhdunn 6mo ago
Some relevant links: [1] https://www.npr.org/2026/04/11/nx-s1-5778508/anthropic-project-glasswing-ai-cybersecurity-mythos-preview https://www.npr.org/2026/04/11/nx-s1-5778508/anthropic-proje... > Improvement in AI models' capabilities became noticeable early 2026, said Daniel Stenberg. > He estimates that about 1 in 10 of the reports are security vulnerabilities, the rest are mostly real bugs. Just three months into 2026, the cURL team Stenberg leads has found and fixed more vulnerabilities than each of the previous two years. [2] https://www.linkedin.com/posts/danielstenberg_curl-activity-7450451335860117504-SM48 https://www.linkedin.com/posts/danielstenberg_curl-activity-... > The new #curl, AI, security reality shown with some graphs. Part of my work-in-progress presentation at foss-north on April 28.

amarcheschi 6mo ago

How many months till they release a better model than mythos to general audience? Gpt 2 wasn't released fully because OpenAI deemed it too dangerous, rings a bell? https://openai.com/index/better-language-models/#sample1 https://openai.com/index/better-language-models/#sample1

Hizonner 6mo ago
A few months of restricting access to people they think will actually fix problems is a big deal. Obviously only an idiot would think it could or should be kept under wraps forever.

deleted 6mo ago

[deleted]

kordlessagain 6mo ago

Those vulnerabilities were found by open models as well.

mccr8 6mo ago
Not really. The models were pointed specifically at the location of the vulnerability and given some extra guidance. That's an easier problem than simply being pointed at the entire code base.
- 0cf8612b2e1e 6mo ago
  Surely the Anthropic model also only looked at one chunk of code at a time. Cannot fit the entire code base into context. So supplying an identical chunk size (per file, function, whatever) and seeing if the open source model can find anything seems fair. Deliberately prompting with the problem is not.
abustamam 6mo ago
Partly true. I think the consensus was it wasn't comparable because Mythos swept the entire codebase and found the vulnerabilities, whereas the open models were told where to look for said vulnerabilities. https://news.ycombinator.com/item?id=47732337 https://news.ycombinator.com/item?id=47732337

mccr8 6mo ago

The flood of reports that open source projects like curl, Linux and Chromium are getting are presumably due to public models like Open 4.6 that released earlier this year, and not models with limited availability.