4 ms·

> This is absolutely still shy of Sol and Fable Not sure about Sol as I haven't used it, but, at least for security work -- does it matter? It's not like you w

> This is absolutely still shy of Sol and Fable Not sure about Sol as I haven't used it, but, at least for security work -- does it matter? It's not like you will be allowed to use Fable (or access Mythos) for anything cybersecurity-related unless your name is "Dario Amodei" or you are one of his rich friends. So regardless of how good Fable/Mythos is here it's a completely moot point for normal people, because they can't use it for that anyway.

bpodgursky 2mo ago
I don't understand all this spite about "rich friends" when it was the US government that shut Fable down for not adequately blocking cyber capabilities. I mean what honestly are you thinking Anthropic can do to give you better cyber tools? Their frontier model was literally nuked by the feds for a month for doing it.
- deepllm 2mo ago
  "Mythos" is the cyber-security equivalent of Fable (without guardrails), and only a very select few corporations have access to it. Fable is their version with guardrails on everything except "Make me a pelican svg" or "create a to-do" app, that is the version that the government banned
  - bpodgursky 2mo ago
    I know all this? Only a few corporations have Mythos because the US government is whitelisting them one at a time. Anthropic releasing Mythos to the public was never on the table, they would have been shut down in milliseconds by the feds if they tried.
    - deepllm 2mo ago
      Before the US government had anything to do with this, Anthropic were fear mongering Mythos (BTW, Amodei also fear-mongered GPT-2, so this is a normal pattern in their operation) calling it "too dangerous to release", and back then only Anthropic was in charge of the whitelist. Then the government believed Amodei's bullshit and this is a result of that, this was all self-inflicted.
      - bpodgursky 2mo ago
        Sorry but if you stepped back for a moment you'd realize this is all contrived nonsense to let to have your cake and eat it too. No, Anthropic did not mind-game the US government into being worried about cybersecurity. The NSA has been paranoid about cyber controls for longer than you've been alive. If Anthropic had come out of the gate saying "no don't worry man, our model is TOTALLY COOL", while simultaneously attacking HAWK and finding core Linux vulnerabilities, I assure you the US government would have caught up about ten minutes later and we'd be in exactly the same spot minus your ability to tell Anthropic they were wearing the wrong dress and asking for it.
        deepllm 2mo ago
        Mythos isn't some scary dangerous model that can find high severity bugs seamlessly, that's just Anthropic marketing. Most of the vulnerabilities they found were low severity hyped up to make their model look good, with (I think, maybe?) the exception of a few. Now that Chinese open weight models have similar capabilities, and their guardrails can also just be removed, it doesn't look like anyone has "hacked" into everything because of the scary dangerous models like Anthropic were making it out to be.
        d1sxeyes 2mo ago
        In principle I agree but in practice I don’t. The majority of high severity vulnerabilities are not the kind of thing you need a PhD in Comp Sci to comprehend, they are mostly about finding a way to get a system to end up in a state different than was anticipated when entering a particular code path. Exhaustively looking at code and identifying ways to do this is something LLMs are quite good at. They don’t get tired, and you can run them non-stop. They're also (generally) quite good at reading the literal meaning of the code, whereas humans often see the intended meaning first, and can be biased. If you had a tireless junior engineer who was given the job of “make this application get into a state it’s not supposed to be in”, you’d probably get similar results. What Mythos is quite good at is both the first bit and coming up with ways it could chain that together with other bits of unexpected state to create something that forms a meaningful vulnerability rather than a dead end.
- kouteiheika 2mo ago
  > I don't understand all this spite about "rich friends" Okay, here's a challenge: I assume you're not a rich and powerful entity, so try to gain access to Mythos. I'll wait. > I mean what honestly are you thinking Anthropic can do to give you better cyber tools? Their frontier model was literally nuked by the feds for a month for doing it. Well, first I'd suggest they stop with the constant fear mongering. Here's my prediction for what will happen: the Chinese models will catch up to Fable/Mythos. They will be fully unrestricted and everyone will have access. The world will not end. Good guys will use them to harden their systems, in equilibrium to what bad guys have access to, so effectively status quo will not change.
  - bpodgursky 2mo ago
    This is a lot of words to say "you're right, Anthropic does not have any legal way to release frontier cyber capabilities to the public"
    - Ydarbleoj 2mo ago
      I still think it's more about the cost of compute than security.
    - kouteiheika 2mo ago
      Right, so according to you it's because of the US government that they don't release it to the public? Have you missed their constant and incessant fear mongering? The causality chain here was not "US government says its dangerous -> Anthropic can't release it", it was "Anthropic is fear mongering -> US government listens to their fear mongering".
    - nozzlegear 2mo ago
      And have nobody to blame for that but themselves and their own scaremongering. Dario cried wolf one too many times, and somebody finally believed him. Of course, Anthropic is after regulator capture, so this all likely worked out exactly as planned.
- stavros 2mo ago
  The issue is that these companies keep trying to pull the ladder up behind them by going "oh my god our models are so dangerous only we should be allowed to develop them". Sometimes it backfires, but the companies aren't innocent.
simonjgreen 2mo ago
We applied for the cybersecurity approval via the form and got approval back in less than an hour. Have you… tried?
- kouteiheika 2mo ago
  Have you tried to use Fable for anything even remotely security related, when the refusals kick in as soon as you even fart in the vague direction of anything security or biology-adjacent?
  - b112 2mo ago
    For this comment to have value, you should indicate whether or not you applied for cybersecurity approval, and were approved or not.
  - simonjgreen 2mo ago
    Our automated CVE testing harness is now powered by Claude after we got the approval. (For interest, we’re using VVAH https://github.com/visa/visa-vulnerability-agentic-harness https://github.com/visa/visa-vulnerability-agentic-harness )
- grey-area 2mo ago
  Are there any limitations on this version?
- alightsoul 2mo ago
  You must be a 5000 person company with an existing enterprise contract to get approved that fast. That sounds like a 15 minute SLA agreement. Individuals no matter how qualified about cybersecurity, are ghosted
  - xx_ns 2mo ago
    That's not my experience at all. I was approved fairly fast - around an hour from submitting the form and getting a response. However, even being in the cybersecurity programme, Fable refuses to answer prompts that it determines could be even tangentially related to cybersecurity. In fact, for a while, I was unable to use Fable with any prompt, as it recalled from memory that I was a cybersecurity professional, which triggered the refusal even for simple prompts like asking for a chili recipe.
deleted 2mo ago
[deleted]

bpodgursky 2mo ago

I don't understand all this spite about "rich friends" when it was the US government that shut Fable down for not adequately blocking cyber capabilities. I mean what honestly are you thinking Anthropic can do to give you better cyber tools? Their frontier model was literally nuked by the feds for a month for doing it.

deepllm 2mo ago
"Mythos" is the cyber-security equivalent of Fable (without guardrails), and only a very select few corporations have access to it. Fable is their version with guardrails on everything except "Make me a pelican svg" or "create a to-do" app, that is the version that the government banned
- bpodgursky 2mo ago
  I know all this? Only a few corporations have Mythos because the US government is whitelisting them one at a time. Anthropic releasing Mythos to the public was never on the table, they would have been shut down in milliseconds by the feds if they tried.
  - deepllm 2mo ago
    Before the US government had anything to do with this, Anthropic were fear mongering Mythos (BTW, Amodei also fear-mongered GPT-2, so this is a normal pattern in their operation) calling it "too dangerous to release", and back then only Anthropic was in charge of the whitelist. Then the government believed Amodei's bullshit and this is a result of that, this was all self-inflicted.
    - bpodgursky 2mo ago
      Sorry but if you stepped back for a moment you'd realize this is all contrived nonsense to let to have your cake and eat it too. No, Anthropic did not mind-game the US government into being worried about cybersecurity. The NSA has been paranoid about cyber controls for longer than you've been alive. If Anthropic had come out of the gate saying "no don't worry man, our model is TOTALLY COOL", while simultaneously attacking HAWK and finding core Linux vulnerabilities, I assure you the US government would have caught up about ten minutes later and we'd be in exactly the same spot minus your ability to tell Anthropic they were wearing the wrong dress and asking for it.
      - deepllm 2mo ago
        Mythos isn't some scary dangerous model that can find high severity bugs seamlessly, that's just Anthropic marketing. Most of the vulnerabilities they found were low severity hyped up to make their model look good, with (I think, maybe?) the exception of a few. Now that Chinese open weight models have similar capabilities, and their guardrails can also just be removed, it doesn't look like anyone has "hacked" into everything because of the scary dangerous models like Anthropic were making it out to be.
        d1sxeyes 2mo ago
        In principle I agree but in practice I don’t. The majority of high severity vulnerabilities are not the kind of thing you need a PhD in Comp Sci to comprehend, they are mostly about finding a way to get a system to end up in a state different than was anticipated when entering a particular code path. Exhaustively looking at code and identifying ways to do this is something LLMs are quite good at. They don’t get tired, and you can run them non-stop. They're also (generally) quite good at reading the literal meaning of the code, whereas humans often see the intended meaning first, and can be biased. If you had a tireless junior engineer who was given the job of “make this application get into a state it’s not supposed to be in”, you’d probably get similar results. What Mythos is quite good at is both the first bit and coming up with ways it could chain that together with other bits of unexpected state to create something that forms a meaningful vulnerability rather than a dead end.
kouteiheika 2mo ago
> I don't understand all this spite about "rich friends" Okay, here's a challenge: I assume you're not a rich and powerful entity, so try to gain access to Mythos. I'll wait. > I mean what honestly are you thinking Anthropic can do to give you better cyber tools? Their frontier model was literally nuked by the feds for a month for doing it. Well, first I'd suggest they stop with the constant fear mongering. Here's my prediction for what will happen: the Chinese models will catch up to Fable/Mythos. They will be fully unrestricted and everyone will have access. The world will not end. Good guys will use them to harden their systems, in equilibrium to what bad guys have access to, so effectively status quo will not change.
- bpodgursky 2mo ago
  This is a lot of words to say "you're right, Anthropic does not have any legal way to release frontier cyber capabilities to the public"
  - Ydarbleoj 2mo ago
    I still think it's more about the cost of compute than security.
  - kouteiheika 2mo ago
    Right, so according to you it's because of the US government that they don't release it to the public? Have you missed their constant and incessant fear mongering? The causality chain here was not "US government says its dangerous -> Anthropic can't release it", it was "Anthropic is fear mongering -> US government listens to their fear mongering".
  - nozzlegear 2mo ago
    And have nobody to blame for that but themselves and their own scaremongering. Dario cried wolf one too many times, and somebody finally believed him. Of course, Anthropic is after regulator capture, so this all likely worked out exactly as planned.
stavros 2mo ago
The issue is that these companies keep trying to pull the ladder up behind them by going "oh my god our models are so dangerous only we should be allowed to develop them". Sometimes it backfires, but the companies aren't innocent.

simonjgreen 2mo ago

We applied for the cybersecurity approval via the form and got approval back in less than an hour. Have you… tried?

kouteiheika 2mo ago
Have you tried to use Fable for anything even remotely security related, when the refusals kick in as soon as you even fart in the vague direction of anything security or biology-adjacent?
- b112 2mo ago
  For this comment to have value, you should indicate whether or not you applied for cybersecurity approval, and were approved or not.
- simonjgreen 2mo ago
  Our automated CVE testing harness is now powered by Claude after we got the approval. (For interest, we’re using VVAH https://github.com/visa/visa-vulnerability-agentic-harness https://github.com/visa/visa-vulnerability-agentic-harness )
grey-area 2mo ago
Are there any limitations on this version?
alightsoul 2mo ago
You must be a 5000 person company with an existing enterprise contract to get approved that fast. That sounds like a 15 minute SLA agreement. Individuals no matter how qualified about cybersecurity, are ghosted
- xx_ns 2mo ago
  That's not my experience at all. I was approved fairly fast - around an hour from submitting the form and getting a response. However, even being in the cybersecurity programme, Fable refuses to answer prompts that it determines could be even tangentially related to cybersecurity. In fact, for a while, I was unable to use Fable with any prompt, as it recalled from memory that I was a cybersecurity professional, which triggered the refusal even for simple prompts like asking for a chili recipe.

deleted 2mo ago

[deleted]