Mythos: not the magical AI hacking tool after all

5 days ago by David Gerard to c/techtakes

Anthropic’s Claude Mythos chatbot was promoted in April as the most frighteningly effective hacking tool ever! Too dangerous for you, the public! The US government even banned Mythos for a couple o…
CorrectAlias 21 points 5 days ago

I'm fucking shocked that it was just marketing! Shocked!

path: 0 26220024, hotness: undefined, score: 21, children: 0
sailor_sega_saturn 15 points 4 days ago

The curl blog post claims that they fixed bunches of other vulnerabilities using AI before this.

Which is to say: even if you accept the questionable premise that AI is "good at finding software vulnerabilities" it doesn't change anything. It's not the end of the world. It's essentially just another fuzzing technique. The low hanging fruit gets discovered and patched, and life goes on (just with more annoying chatbot spam than before).

I was trying to tell my coworkers this when Mythos was in the news but they were all freaking out about no software ever being secure ever again or something rather than at best a one time blip.

path: 0 26221556, hotness: undefined, score: 15, children: 4
terranoid 6 points 4 days ago

Exactly. People don't understand how many webapp vulns there are out there, low hanging fruit that is pretty damn easy to find if you know how it works, because it's fucking everywhere. Like reflected xss, once I figured it out, I checked random sites and it's just fucking everywhere. Less so with good React apps these days, but even then, still everywhere.

It doesn't mean the internet doesn't work or that every app is immediately hacked. That XSS existed then, it exists now, and even if mythos finds it, doesn't mean it gets exploited or even fixed for the next year.

People outside of directly knowing how xss works are super impressed by it, and the AI scam artists took advantage of that. It sells the product, makes it seem like some cyberpunk super hacker. It's never been that huge of a deal or complex to find.

I mean, you might end up with some interesting ai boosted threat actors these days... But it's not the end of the world. People were always doing weird shit. Things were always getting hacked. Nation state threat groups are probably just a bit more dangerous when they were already very dangerous in this respect.

path: 0 26221556 26223201, hotness: undefined, score: 6, children: 0
Soyweiser 3 points 4 days ago

How many of those coworkers were also all in on room temp copper superconductors?

path: 0 26221556 26235449, hotness: undefined, score: 3, children: 2
sailor_sega_saturn 2 points 4 days ago

One of them is enamored with Elon Musk. I just stay quiet about that.

I can't quit for another year or two for healthcare reasons but I'll be so glad when I can finally say goodbye to that god-forsaken job.

path: 0 26221556 26235449 26238891, hotness: undefined, score: 2, children: 1
Soyweiser 1 point 3 days ago

Oh no thats worse.

path: 0 26221556 26235449 26238891 26243644, hotness: undefined, score: 1, children: 0
IMALlama 7 points 5 days ago

Click the arrival link in the header if you skipped it. There are some great quotes in there and lots of sources.

Eleven of them were famously found and fixed by other people! In public, before this report even came out. They scraped the web and found the bugs.

path: 0 26220363, hotness: undefined, score: 7, children: 0
techtakes
techtakes

@awful.systems

login for more options
2725
1522
1717

Big brain tech dude got yet another clueless take over at HackerNews etc? Here's the place to vent. Orange site, VC foolishness, all welcome.

This is not debate club. Unless it’s amusing debate.

For actually-good tech, you want our NotAwfulTech community

go to feed...