5 ms·

I'll share the first-hand account I recently got from someone else. > We've used it at work > it is... not as hype as everyone is concerned about > I'd argue

I'll share the first-hand account I recently got from someone else. > We've used it at work > it is... not as hype as everyone is concerned about > I'd argue the framework around it for security scanning is the arguably more useful side of the tool, definitely doesnt take a huge model to get all the issues it flagged on our systems > For us, it absolutely flooded us with noise > I mean hundreds if not thousands of false positives or minor issues or not applicable > For every one reasonable issue > The biggest issue it created was the execs treated every issue it produced like it was a drop everything and fix the issue type deal > I'm talking company wide drop all things "we need to patch nginx because this module that no one uses and is disabled by default has this RCE vulnerability™ > Or "all ec2 AMIs need to be upgraded because it flagged a a version specific docker vulnerability", it flagged every single machine with docker regardless of if the actual vulnerability was relevant > Vulnerability was with a very specific Auth plugin configuration you could enable with docker and specifically the Mosley docker compatible tool, but it is clear it only knew there was a vulnerability in docker, not if it was applicable or not > Meanwhile dirtyfrag and friends not a single peep from btw despite it allowing for container escape > Idk, I was underwhelmed with the quality of the reporting it gave really. If the company allowed me to get information about all the infrastructure in our entire organisation to run Claude over it repeatedly looking for recent CVEs I'm sure I could produce the same results...

jr-throw 5mo ago
I'm pretty impressed with regular Claude Code with Opus 4.7/4.8 in finding vulnerabilities in our code. Maybe 70% are false positives though. It's a lot of work to manually push back on the findings. Still worth it.
- steve_adams_86 5mo ago
  It's similar with performance optimizations. One example was Claude thinking we could optimize converting vector tiles to raster by operating in float32 rather than float64. It turned out the library we have to use casts to float64 anyway, so the work of casting to 32 then to 64 rather than staying at 64 actually slowed the path down by 12%. Yet it also finds the odd thing that isn't very intuitive but leads to marked improvements I never would have uncovered because... Well, as a human with only 24 hours in a day, there's no way I'll turn over every leaf and find these items on my own. I'm totally fine with the false positives because they're so easy the verify.
bgilroy26 5mo ago
It seems like there is a genuine communication breakdown between management and engineering. Engineers know that there are vulnerabilities all over the place and that there have been for ages and that where the rubber hits the road every vulnerability does not represent a successful exploit by some nefarious actor. Management can often treat cybersecurity like a black box that represents millions upon millions in liability. If Mythos represents an opportunity to bring management's understanding of the amount of "security vulnerability debt" everyone carries into the real world, it might be a good thing
- thewebguyd 5mo ago
  It won't bring understanding though is the problem. You get situations like the parent, where the execs don't have the knowledge, time, or care to learn beyond "vulnerability bad, must patch now" Execs/Management types getting extra visibility into the technical side, in my experience, has only ever resulted in additional but meaningless work, like just checking boxes on a compliance/audit checklist without actually considering the impacts of those changes, or whether a company is actually vulnerable to the disclosed CVE. It's along the same lines of the BS I deal with day to day from upper management arguing back with "But ChatGPT said..." meanwhile pasting some hallucinated crap that doesn't even apply to our environment. LLMs are basically a dunning-kruger machine for management. Engineering is best left alone and trusted to do what they are being paid to do.
- _puk 5mo ago
  [dead]
- torginus 5mo ago
  I had a geniunely surreal conversation with the security team the past week, it went like: 'Hi, we are reaching out to you because our tool flagged a large data transfer between such and such services' 'Wait, the source endpoint is an internal service, the target endpoint is an internal S3 bucket (I was doing a routine DB backup) Neither are reachable from the internet. How is it a security issue?' 'Our tool has flagged it'
  - 5mo ago
mohamedkoubaa 5mo ago
In other words it is equivalent to spending a million dollars on an audit by a software security consulting company
- lgpartman 5mo ago
  Or to RedHat for rewriting Python core 500 times. The "humans do it too" argument gets tiresome. Even if the consulting company fails, the money goes back to employees and back into the real economy. Now it goes to Don Amodei. The consulting company could be local, which provides a higher degree of confidence, though not proof, that no data is exfiltrated to the US. And so on.
Almondioco 5mo ago
I think Opus 4.6 and Mythos overall/marketing wise are key points because it told the world that LLMs are now a critical / usefull tool for security audits. Its aligns with the significant jump in helpfulness in CTF. But i think its good to hear that its not that crazy good. Everything slowing it down is good.
jsisto 5mo ago
This reminds me of when I added Snyk to our CI/CD and brought development to a standstill
- zwigglers 5mo ago
  Same pattern. Scanners flag everything. The problem is there's no layer between findings and everyone's inbox. Prioritization is harder than detection.
AlexCoventry 5mo ago
I thought one of the advantages of Glasswing was that it could produce a PoC for you. Was it producing working PoC's?
0123456789ABCDE 5mo ago
why are folks looking at the output of the first pass? my understanding, and experience, is that you 1. run a bunch of sessions with small permutations to create variety, 2. run more sessions dedupe reports into a smaller collections of potential vulns, 3. run a handful of agents at max effort to write PoCs + write-ups, 4. rank findings, 5. finally look at what, if anything that, was found. maybe ask questions, try and understand if the PoC is running against a realistic setup. until you can confirm a vuln report is valid, you must assume it is invalid.
- SpicyLemonZest 5mo ago
  What Project Glasswing claimed at launch is that Mythos can "surpass all but the most skilled humans at finding and exploiting software vulnerabilities". What you're describing sounds more like making skilled humans more effective at penetration testing. That's cool, but it's not clear how much it matters, because most security teams were not previously bottlenecked on penetration testing capacity.
  - 0123456789ABCDE 5mo ago
    i wasn't thinking about pen-testing, but vulnerability-research, which seems to match that quote. but, you're right, gp is referring to "security scanning". i just feel like, even then whoever's running the research, should triage and validate results, before passing on to mgmt.
sbayg 5mo ago
In other words it creates work. In other words Jevons paradox. I can’t wait for the first court case where an LLM surfaces a vuln, lazy devs ignore it, and someone later sues the company into oblivion for liability.
- fn-mote 5mo ago
  When was the last time you remember a company being sued into oblivion for a security breach? The cost in the US is more like “one year of credit monitoring”.
Escapade5160 5mo ago
This is the same gripe I have over any LLM vulnerability tooling. 95% of what gets flagged is something that if taken by itself could be a vulnerability. However, the path to execute that specific vuln, in that specific function, is impossible in that particular code base and it just makes noise.
jen20 5mo ago
> The biggest issue it created was the execs treated every issue it produced like it was a drop everything and fix the issue type deal While this is definitely not the ideal end of the spectrum either, execs treating security issues as something serious instead of annoyances that should only be addressed if revenue can be tied to doing so is a welcome improvement.
protocolture 5mo ago
Seems like there might be a market for a product that just prefixes "The AI Said" on emails to executives about security vulns.
huflungdung 5mo ago
[dead]

jr-throw 5mo ago

I'm pretty impressed with regular Claude Code with Opus 4.7/4.8 in finding vulnerabilities in our code. Maybe 70% are false positives though. It's a lot of work to manually push back on the findings. Still worth it.

steve_adams_86 5mo ago
It's similar with performance optimizations. One example was Claude thinking we could optimize converting vector tiles to raster by operating in float32 rather than float64. It turned out the library we have to use casts to float64 anyway, so the work of casting to 32 then to 64 rather than staying at 64 actually slowed the path down by 12%. Yet it also finds the odd thing that isn't very intuitive but leads to marked improvements I never would have uncovered because... Well, as a human with only 24 hours in a day, there's no way I'll turn over every leaf and find these items on my own. I'm totally fine with the false positives because they're so easy the verify.

bgilroy26 5mo ago

It seems like there is a genuine communication breakdown between management and engineering. Engineers know that there are vulnerabilities all over the place and that there have been for ages and that where the rubber hits the road every vulnerability does not represent a successful exploit by some nefarious actor. Management can often treat cybersecurity like a black box that represents millions upon millions in liability. If Mythos represents an opportunity to bring management's understanding of the amount of "security vulnerability debt" everyone carries into the real world, it might be a good thing

thewebguyd 5mo ago
It won't bring understanding though is the problem. You get situations like the parent, where the execs don't have the knowledge, time, or care to learn beyond "vulnerability bad, must patch now" Execs/Management types getting extra visibility into the technical side, in my experience, has only ever resulted in additional but meaningless work, like just checking boxes on a compliance/audit checklist without actually considering the impacts of those changes, or whether a company is actually vulnerable to the disclosed CVE. It's along the same lines of the BS I deal with day to day from upper management arguing back with "But ChatGPT said..." meanwhile pasting some hallucinated crap that doesn't even apply to our environment. LLMs are basically a dunning-kruger machine for management. Engineering is best left alone and trusted to do what they are being paid to do.
_puk 5mo ago
[dead]
torginus 5mo ago
I had a geniunely surreal conversation with the security team the past week, it went like: 'Hi, we are reaching out to you because our tool flagged a large data transfer between such and such services' 'Wait, the source endpoint is an internal service, the target endpoint is an internal S3 bucket (I was doing a routine DB backup) Neither are reachable from the internet. How is it a security issue?' 'Our tool has flagged it'
- 5mo ago

mohamedkoubaa 5mo ago

In other words it is equivalent to spending a million dollars on an audit by a software security consulting company

lgpartman 5mo ago
Or to RedHat for rewriting Python core 500 times. The "humans do it too" argument gets tiresome. Even if the consulting company fails, the money goes back to employees and back into the real economy. Now it goes to Don Amodei. The consulting company could be local, which provides a higher degree of confidence, though not proof, that no data is exfiltrated to the US. And so on.

Almondioco 5mo ago

I think Opus 4.6 and Mythos overall/marketing wise are key points because it told the world that LLMs are now a critical / usefull tool for security audits. Its aligns with the significant jump in helpfulness in CTF. But i think its good to hear that its not that crazy good. Everything slowing it down is good.

jsisto 5mo ago

This reminds me of when I added Snyk to our CI/CD and brought development to a standstill

zwigglers 5mo ago
Same pattern. Scanners flag everything. The problem is there's no layer between findings and everyone's inbox. Prioritization is harder than detection.

AlexCoventry 5mo ago

I thought one of the advantages of Glasswing was that it could produce a PoC for you. Was it producing working PoC's?

0123456789ABCDE 5mo ago

why are folks looking at the output of the first pass? my understanding, and experience, is that you 1. run a bunch of sessions with small permutations to create variety, 2. run more sessions dedupe reports into a smaller collections of potential vulns, 3. run a handful of agents at max effort to write PoCs + write-ups, 4. rank findings, 5. finally look at what, if anything that, was found. maybe ask questions, try and understand if the PoC is running against a realistic setup. until you can confirm a vuln report is valid, you must assume it is invalid.

SpicyLemonZest 5mo ago
What Project Glasswing claimed at launch is that Mythos can "surpass all but the most skilled humans at finding and exploiting software vulnerabilities". What you're describing sounds more like making skilled humans more effective at penetration testing. That's cool, but it's not clear how much it matters, because most security teams were not previously bottlenecked on penetration testing capacity.
- 0123456789ABCDE 5mo ago
  i wasn't thinking about pen-testing, but vulnerability-research, which seems to match that quote. but, you're right, gp is referring to "security scanning". i just feel like, even then whoever's running the research, should triage and validate results, before passing on to mgmt.

sbayg 5mo ago

In other words it creates work. In other words Jevons paradox. I can’t wait for the first court case where an LLM surfaces a vuln, lazy devs ignore it, and someone later sues the company into oblivion for liability.

fn-mote 5mo ago
When was the last time you remember a company being sued into oblivion for a security breach? The cost in the US is more like “one year of credit monitoring”.

Escapade5160 5mo ago

This is the same gripe I have over any LLM vulnerability tooling. 95% of what gets flagged is something that if taken by itself could be a vulnerability. However, the path to execute that specific vuln, in that specific function, is impossible in that particular code base and it just makes noise.

jen20 5mo ago

> The biggest issue it created was the execs treated every issue it produced like it was a drop everything and fix the issue type deal While this is definitely not the ideal end of the spectrum either, execs treating security issues as something serious instead of annoyances that should only be addressed if revenue can be tied to doing so is a welcome improvement.

protocolture 5mo ago

Seems like there might be a market for a product that just prefixes "The AI Said" on emails to executives about security vulns.

huflungdung 5mo ago

[dead]