4 ms·
We (Project Glasswing users) follow a proof-of-concept approach. We create the exploit and verify that it behaves as the AI claims. Given our experience as secu
by guessmyname 3mo ago
We (Project Glasswing users) follow a proof-of-concept approach. We create the exploit and verify that it behaves as the AI claims. Given our experience as security engineers (many of us with 10+ YoE) we don’t simply report every critical bug Mythos claims to have found. We verify each one carefully.
At least, that’s what most of the high-visibility users in Project Glasswing are doing.
There are bad apples everywhere, and this initiative is no exception.
If it makes you feel any better, many of us regularly meet to stay calibrated and hold each other accountable, so I’m confident in the quality of the work produced by this particular group of employees across some of the partner companies mentioned in the article.
That said, I know several people who blindly report everything Mythos finds, which is foolish, especially since the harness is a critical part of the project's quality metrics. Some of the harnesses I’ve tested are quite weak, which leads to poor results.
For example, yesterday morning I was pulled into an ad hoc meeting where a CVP was grilling me about several supposedly critical bugs that my team had reported against one of the core components of iCloud. I was genuinely surprised because we’re very strict about validation. We often even downgrade the severity of bugs when our harness can’t prove what Mythos found. After reading the reports, I realized they weren’t ours. They came from another team that had recently been given access to Mythos. They built their own harness and were using different vulnerability criteria. Fortunately, they had only started earlier this week, so I was able to stop that work.
That incident showed that not everyone involved in Project Glasswing follows the same standards. Most people do their best, but priorities differ, so it’s expected that you’ll find a few bad apples.
I wish AI labs would stop the theatrics and release their models without restrictions, but I also recognize that’s not the world we live in. For every person who wants to use these technologies for good, there are many others who would use them for harm.
In any case, while I agree that some experiments contain genuine noise, the CVE count is real.
- NomDePlum 3mo ago[dead]
- IAmGraydon 3mo ago>We (Project Glasswing users) follow a proof-of-concept approach. We create the exploit and verify that it behaves as the AI claims. Given our experience as security engineers (many of us with 10+ YoE) we don’t simply report every critical bug Mythos claims to have found. We verify each one carefully. >That incident showed that not everyone involved in Project Glasswing follows the same standards.
- altmanaltman 3mo agoIts very hard to understand what you're saying with the comment - like you have 10+ years of experience and you verify each bug because you know Mythos can provide fake positives. But other teams (which also should have people equivalent to your skill and experience level) suck at it so much that CVP level workers are having to spend time on their fake reports. Then you say Anthropic should stop theater. Then you say the cve count is real. It genuinely felt like the aladin scene in The Dictator reading this comment.
- guessmyname 3mo agoI didn’t claim to have 10+ YoE; I said that most of the people in Project Glasswing are security researchers with 10+ YoE (avg). > Its very hard to understand what you're saying with the comment Yes, fair enough. I’m simply trying to shed some light on what goes on behind the scenes without disclosing too much information to avoid breaching the NDA(s) that all Project Glasswing users have signed. There’s a lot of speculation about the usefulness of Mythos as a security tool, so much so that even the US government got involved. Honestly, it’s so absurd that I can’t even express it in words. I thought that sharing a bit about how frustrating it is to work within this project, trying to secure software that literally millions of people around the planet use on a daily basis, while virtually everyone outside of it criticizes every move you make, would be helpful. Many people I work with recognize the power of Mythos, just like any other model with a similar number of parameters, but most of the people I interact with agree that it’s not the ultimate panacea. I believe that it’s just vocal minorities scaring everyone into thinking that the model is some kind of cybernetic weapon.
- hatefulheart 3mo ago[flagged]
- intended 3mo agoI care. HN has always been a place where people get to learn and understand things from viewpoints and domains they don’t work in. It seems that HN has more people who want to just build stuff, than people who have to fix security issues. Discussing security is itself a challenge, because of NDAs. I don’t think any sane adult assumes that sweeping stuff under the rug means the problem has gone away.
- deleted 3mo ago[deleted]
- nullbio 3mo agoThis sounds like pure propaganda. Are people actually buying this?
- KronisLV 3mo ago> Some of the harnesses I’ve tested are quite weak, which leads to poor results. So in your opinion, what would be the best off the shelf options? And secondly, how much better you’d say a purpose built one is compared to a general purpose one with a good system prompt?
- cmxch 3mo agoShow your work so others can reproduce it. Or it functionally does not exist. (No, long hashes with an equally mythic promise of reproducibility don’t count)