Anthropic’s Mythos has flagged bugs faster than Microsoft can fix them. Documents reviewed by ProPublica reveal the tech giant's “mad dash” behind the scenes to patch holes before hackers can find and exploit them.
Can anybody help me understand the threat of these advanced models once the public and adversaries have access to them? I understand they can find software bugs and vulnerabilities and I get that US tech companies are using it to make their software more secure, but all of these companies have the benefit of their source code being available as an input to the model. Everybody else only has compiled binaries. Do the bad guys use the models to decompile or reverse engineer the code first?
There are common techniques that can be used broadly to get results with LLMs.
Some source code is floating around out there, like it is mentioned in the article.
Yes, decompilation techniques are something that cannot be prevented and are sped up by LLMs.
There are only so many devs patching bugs, while there might be millions trying to break in - they mentioned the chaining of multiple “low”-priority bugs to escalate the severity, and if you need months to even get the really dangerous stuff fixed, it’s a free-for-all bonanza as soon as those models hit the public, and these people don’t even need to know anything about cybersecurity - Joe Shmoe can tell Mythos to “go hack Onedrive” and that’s all that is needed from Joe Shmoe.
Can anybody help me understand the threat of these advanced models once the public and adversaries have access to them? I understand they can find software bugs and vulnerabilities and I get that US tech companies are using it to make their software more secure, but all of these companies have the benefit of their source code being available as an input to the model. Everybody else only has compiled binaries. Do the bad guys use the models to decompile or reverse engineer the code first?
Yes, and AI probably helps with that.