3 ms·
I commented this in another post but I'm going to repeat it because I believe its important for this discussion. > The worrying part about Mythos isn't the fac
by wnevets 5mo ago
I commented this in another post but I'm going to repeat it because I believe its important for this discussion.
> The worrying part about Mythos isn't the fact that it can find bugs. The worrying part is Mythos being able to find them on its own across entire code base as vast as Firefox then write exploits for what its found with a very basic prompt.
> The skill required to find then create zero days is quickly approaching the floor.
- colechristensen 5mo agoOpus can find bugs on its own in large codebases just fine with minimal prompting. The great exaggeration is that this is a new capability.
- wnevets 5mo ago> Opus can find bugs on its own in large codebases just fine with minimal prompting. and then it write the exploits automatically for you?
- colechristensen 5mo agoYes
- wnevets 5mo agoCan you send me that link?
- colechristensen 5mo agoWhat link? I've done it myself.
- wnevets 5mo agoYou've pointed codex to the entire source code of firefox and simply prompted it to find bugs and then had it write the exploits for you? Why haven't you published this? That would sink all of the the claude code hype.
- colechristensen 5mo agoNo, I'm not interested in Firefox bugs, but I've done it with my own large projects. What I think happened here is an Anthropic team with very little security expertise were working on finding bugs for marketing reasons and when they prompted to make POC exploits of those bugs they didn't have much success because they didn't really know what to ask for. They then proceeded to very finely tune their next model to eagerly exploit vulnerabilities making the models much more powerful for the "I don't know what I'm doing" user which they're now trying really hard to convince everyone is a game changer. </speculation> The reason many of us are skeptical is we've used the current models to do things and they've worked. An analogy might be if they tuned their model to eagerly instruct somebody how to make improvised weapons, now somebody is asking about how to deal with a rival at work and their model gives instructions on building a bomb from hardware store parts. Then go on a marketing spree telling everybody how dangerous it is. This example might highlight how insincere the marketing is. At any point you could have tuned the model to exploit for inexperienced people, now that you've done it does not mark a grand new capability. People who knew what they were doing could already do this with models. https://www.anthropic.com/news/mozilla-firefox-security https://www.anthropic.com/news/mozilla-firefox-security
- wnevets 5mo ago> No, I'm not interested in Firefox bugs, but I've done it with my own large projects. Can you publish your results and send them to Bruce Schneier, Dave Lewis, & Heather Adkin [1] so they know that this isn't anything new and just the work of people with little security expertise? [1] https://labs.cloudsecurityalliance.org/mythos-ciso/ https://labs.cloudsecurityalliance.org/mythos-ciso/
- 5mo ago
- ofjcihen 5mo agoDoes this mean you’re only using the models in the web app? I mean that might be why you haven’t been able to do this?
- ofjcihen 5mo agoI will never ever understand how people are amazed by this. Have they just not tried it and then just assume that because Anthropic says this is the first it must be true? This was one of the first things I tried and it works great.