Honestly, his mind and the community is probably one of the best things out there at the moment. They live the Linux Kernel, while that thing he used does not think or understand anything. Eh, it would be better if they moved with care instead, as that is a good way to avoid bugs too. I don’t have a lot of faith in gassed up LLMs.
He’s doing it though. So that’s kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that’s already making it more secure by finding multiple exploits is the right choice of what to use.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.
Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn’t want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.
Honestly, his mind and the community is probably one of the best things out there at the moment. They live the Linux Kernel, while that thing he used does not think or understand anything. Eh, it would be better if they moved with care instead, as that is a good way to avoid bugs too. I don’t have a lot of faith in gassed up LLMs.
He’s doing it though. So that’s kind or moot. Fable is out there finding bugs in these things, so seems like if he is going to do it, using the thing that’s already making it more secure by finding multiple exploits is the right choice of what to use.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.
Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn’t want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.