Anthropic’s Mythos has flagged bugs faster than Microsoft can fix them. Documents reviewed by ProPublica reveal the tech giant's “mad dash” behind the scenes to patch holes before hackers can find and exploit them.
Can anybody help me understand the threat of these advanced models once the public and adversaries have access to them? I understand they can find software bugs and vulnerabilities and I get that US tech companies are using it to make their software more secure, but all of these companies have the benefit of their source code being available as an input to the model. Everybody else only has compiled binaries. Do the bad guys use the models to decompile or reverse engineer the code first?
One threat: people using the models are finding bugs and the more rare exploits at a much faster rate than before, perhaps 10x. This means that zero-day exploits are coming into the hands of the kinds of people who use them for bad purposes about 10x faster than they used to. It also means the white hats are creating these CVEs faster and people addressing the CVEs are able to do so faster, with the same manpower… so… if either side slows down, it will shift the balance we currently have toward their opponents.
There are common techniques that can be used broadly to get results with LLMs.
Some source code is floating around out there, like it is mentioned in the article.
Yes, decompilation techniques are something that cannot be prevented and are sped up by LLMs.
There are only so many devs patching bugs, while there might be millions trying to break in - they mentioned the chaining of multiple “low”-priority bugs to escalate the severity, and if you need months to even get the really dangerous stuff fixed, it’s a free-for-all bonanza as soon as those models hit the public, and these people don’t even need to know anything about cybersecurity - Joe Shmoe can tell Mythos to “go hack Onedrive” and that’s all that is needed from Joe Shmoe.
Can anybody help me understand the threat of these advanced models once the public and adversaries have access to them? I understand they can find software bugs and vulnerabilities and I get that US tech companies are using it to make their software more secure, but all of these companies have the benefit of their source code being available as an input to the model. Everybody else only has compiled binaries. Do the bad guys use the models to decompile or reverse engineer the code first?
One threat: people using the models are finding bugs and the more rare exploits at a much faster rate than before, perhaps 10x. This means that zero-day exploits are coming into the hands of the kinds of people who use them for bad purposes about 10x faster than they used to. It also means the white hats are creating these CVEs faster and people addressing the CVEs are able to do so faster, with the same manpower… so… if either side slows down, it will shift the balance we currently have toward their opponents.
Yes, and AI probably helps with that.