[HN Gopher] Assessing Claude Mythos Preview's cybersecurity capa...
___________________________________________________________________
Assessing Claude Mythos Preview's cybersecurity capabilities
Related: _Project Glasswing: Securing critical software for the AI
era_ - https://news.ycombinator.com/item?id=47679121 _System
Card: Claude Mythos Preview [pdf]_ -
https://news.ycombinator.com/item?id=47679258 Also: _Anthropic 's
Project Glasswing sounds necessary to me_ -
https://news.ycombinator.com/item?id=47681241
Author : sweis
Score : 228 points
Date : 2026-04-07 18:11 UTC (4 hours ago)
(HTM) web link (red.anthropic.com)
(TXT) w3m dump (red.anthropic.com)
| AntiDyatlov wrote:
| A very good outcome for AI safety would be if when improved
| models get released, malicious actors use them to break society
| in very visible ways. Looks like we're getting close to that
| world.
| sourcecodeplz wrote:
| Gives me Fight Club vibes.
| pants2 wrote:
| It would certainly be good news for cybersecurity employment!
| awestroke wrote:
| This is becoming a bit scary. I almost hope we'll reach some kind
| of plateau for llm intelligence soon.
| websap wrote:
| If we don't innovate, someone else will. This is the very
| nature of being a human being. We summit mountains, regardless
| of the danger or challenge.
| vonneumannstan wrote:
| >If we don't innovate, someone else will.
|
| Terrible take. You don't get to push the extinction button
| just because you think China will beat you to the punch.
|
| >This is the very nature of being a human being. We summit
| mountains, regardless of the danger or challenge.
|
| No, just no... We barely survived the Cold War, at times
| because of pure luck. AI is at least as dangerous as that, if
| not more. We have far exceeded our wisdom relative to our
| capabilities. As you have so cleanly demonstrated.
| dist-epoch wrote:
| You assume there is the option of not pushing the
| extinction button. Nobody asked chimps if they wanted
| humans around. This processes are outside control.
| esafak wrote:
| We need to promote alignment and other ethics benchmarks; we
| can't change what we don't measure. I don't even know any off
| the top of my head.
| hibikir wrote:
| On a topic like cybersecurity, we never win by not looking: One
| needs top of the line knowledge of how to break a system to be
| able to protect it. We have that dilemma dealing with human
| experts: The same government sponsored unit that tells you that
| you need to update your encryption can hold on to the
| information and use it to exploit it at their leisure.
|
| Given that it's absolutely impossible to stop people not
| aligned with us (for any definition of us) from doing AI
| research, the most reasonable way forward is to dedicate
| compute resources to the frontier, and to automatically send
| reasonable disclosures to major projects. It could in itself be
| a pretty reasonable product. Just like you pay for dubious
| security scans and publish that you are making them, an LLM
| company could offer actually expensive security reviews with a
| preview model, and charge accordingly.
| lebovic wrote:
| A plateau is unlikely, at least for cybersecurity. RL scales
| well here and is replicable outside of Anthropic (rewards are
| verifiable, so setting up the training environment doesn't
| require that much cleverness).
|
| The post also points out that the model wasn't trained
| specifically on cybersecurity, and that it was just a side-
| effect - so I think there's still a lot of headroom.
|
| It's scary, but there's also some room for cautious non-
| pessimism. More people than ever can cause billions of dollars
| of damage in attacks now [1], but the same tools can be used
| for defensive use. For that reason, I'm more optimistic about
| mitigations in security vs. other risk areas like biosecurity.
|
| [1]: https://www.noahlebovic.com/testing-an-autonomous-hacker/
| dist-epoch wrote:
| The immediate plateau is the energy output of the Sun captured
| by the Dyson Swarm around it. Until there it's smooth sailing.
| staticassertion wrote:
| I'd love to see them point at a target that's not a decades old
| C/C++ codebase. Of the targets, only browsers are what should be
| considered hardened, and their biggest lever is sandboxing, which
| requires a lot of chained exploits to bypass - we're seeing that
| LLMs are fast to discover bugs, which means they can chain more
| easily. But bug density in these code bases is known to be
| extremely high - especially the underlying operating systems,
| which are always the weak link for sandbox escapes.
|
| I'd love to see them go for a wasm interpreter escape, or a
| Firecracker escape, etc. They say that these aren't just "stack-
| smashing" but it's not like heap spray is a novel technique lol
|
| > It autonomously obtained local privilege escalation exploits on
| Linux and other operating systems by exploiting subtle race
| conditions and KASLR-bypasses.
|
| I think this sounds more impressive than it is, for example.
| KASLR has a terrible history for preventing an LPE, and LPE in
| Linux is incredibly common. Has anything changed here? I don't
| pay much attention but KASLR was considered basically useless for
| preventing LPE a few years ago.
|
| > Because these codebases are so frequently audited, almost all
| trivial bugs have been found and patched. What's left is, almost
| by definition, the kind of bug that is challenging to find. This
| makes finding these bugs a good test of capabilities.
|
| This just isn't true. Humans find new bugs in all of this
| software constantly.
|
| It's all very impressive that an agent can do this stuff, to be
| clear, but I guess I see this as an obvious implication of
| "agents can explore program states very well".
|
| edit: To be clear, I stopped about 30% of the way through. Take
| that as you will.
| rfoo wrote:
| > Mythos Preview identified a memory-corruption vulnerability
| in a production memory-safe VMM. This vulnerability has not
| been patched, so we neither name the project nor discuss
| details of the exploit.
|
| Good morning Sir.
|
| > Has anything changed here? I don't pay much attention but
| KASLR was considered basically useless for preventing LPE a few
| years ago.
|
| No. It's still like this. Bonus point that there are always
| free KASLR leaks (prefetch side-channels).
|
| But then, this thing is just.. I don't have a word for this.
| Just randomly read paragraphs from the post and it's like,
| what?
| staticassertion wrote:
| Oh, that. That's true, I didn't know Mythos found that one. I
| guess I will not comment further on it until there's a write
| up (edited out a bit more).
|
| > It is easy to turn this into a denial-of-service attack on
| the host, and conceivably could be used as part of an exploit
| chain.
|
| So yeah, perhaps some evidence to what I'm getting at. Bug
| density is too low in that project, it's high enough in
| others. I'll be way way way more interested in that.
|
| > But then, this thing is just.. I don't have a word for
| this. Just randomly read paragraphs from the post and it's
| like, what?
|
| I read about 30% and got bored. I suppose I should have been
| clearer, but my impression was pretty quickly "cool" and "not
| worth reading today".
| rfoo wrote:
| > I read about 30% and got bored.
|
| I was lucky then :) Somehow I saw this first. And then the
| "somewhat reliably writing exploits for SpiderMonkey" part,
| and then the crypto libraries part. Finally I wonder why is
| there a Linux LPE mini writeup and realized it's the
| "automatically turn a syzkaller report to a working
| exploit" part.
|
| Now that I read the first few things (meh bugs in OpenBSD,
| FFmpeg, FreeBSD etc) they are indeed all pretty boring!
| staticassertion wrote:
| If people want exploitable syzkaller reports, following
| spender is free!
| jryio wrote:
| The majority of vulnerabilities are in newly committed lines of
| code. This has been shown again and again [1] [2]
|
| From a marketing standpoint Anthropic is showing that they're
| able to direct 'compute' to find vulnerabilities where human
| time/cost is not efficient or effective.
|
| Project Glasswing is attempting to pay off as many of these old
| vulnerabilities as possible now so the low-hanging fruit has
| already been picked.
|
| The next generation of Mythos and real world vulnerabilities
| exploits are going to be in newly committed code...
|
| [1]: https://dl.acm.org/doi/epdf/10.1145/2635868.2635880
|
| [2]: https://arxiv.org/abs/2601.22196
| staticassertion wrote:
| > The majority of vulnerabilities are in newly committed
| lines of code. This has been shown again and again
|
| That's fine, I wouldn't argue against that. It doesn't really
| change things, right?
|
| > From a marketing standpoint Anthropic is showing that
| they're able to direct 'compute' to find vulnerabilities
| where human time/cost is not efficient or effective.
|
| Yes, they've demonstrated that.
| jiehong wrote:
| The name made me think about Tales of Symphonia :)
| dang wrote:
| Related ongoing threads:
|
| _System Card: Claude Mythos Preview [pdf]_ -
| https://news.ycombinator.com/item?id=47679258
|
| _Project Glasswing: Securing critical software for the AI era_ -
| https://news.ycombinator.com/item?id=47679121
|
| I can't tell which of the current threads, if any, should be
| merged - they all seem significant. Anyone?
| coffeebeqn wrote:
| There is a lot to digest here. Maybe having a few separate
| pages makes them a bit more digestible. The system card itself
| is some 200 odd pages
| avsm wrote:
| The elephant in the room here is that there are hundreds of
| millions of embedded devices that cannot be upgraded easily and
| will be running vulnerable binaries essentially forever. This was
| a problem before of course, but the ease of chaining
| vulnerabilities takes the issue to a new level.
|
| The only practical defense is for these frontier models to
| generate _beneficial_ attacks to innoculate older binaries by
| remote exploits. I dubbed these 'antibotty' networks in a
| speculative paper last year, but never thought things would move
| this fast! https://anil.recoil.org/papers/2025-internet-
| ecology.pdf
| gmuslera wrote:
| No, the elephant in the room is that even bad actors will now
| have easier to find vulnerabilities in, maintained or not,
| widely or in critical places used software. Unmaintained and
| remotely accessible devices should be discarded as soon as
| possible, you can't stay waiting till some of the good guys
| decide to give some time to your niche but critical
| unmaintained piece of software. Because if there is a
| possibility of taking profit of it, it will be checked and
| exploited.
|
| And you can't assume that whatever vulnerability they have will
| let good guys to do the extra (and legally risky) work of
| closing the hole.
| touristtam wrote:
| _SHOULD_ yes sure, but realistically is that going to happen?
| michaelbuckbee wrote:
| As doom and gloom as things are generally, I do think
| things have gotten better. Due to legislation and
| commercial pressure things like wifi routers shipping with
| the same default password and open settings have gotten
| better. Webhosts and ISPs have implemented many
| improvements to protecting their residential customers.
|
| I take your point, but think that it's also maybe too far.
| cluckindan wrote:
| Since this level of security "scanning" requires heaps of money,
| this is going to kill off a substantial part of F/OSS.
| chris_st wrote:
| Well, maybe not... see Simon Willison's ongoing reporting [0]
| on all the bug reports for `curl` people are finding with LLMs.
|
| Interesting to see them go from "DON'T GIVE US AI SLOP!" to
| "Wow, lots of actual bugs found, including [ed: at least one]
| bug found by two people!"
|
| [0]: https://simonwillison.net/search/?q=curl
| torginus wrote:
| My two cents is LLMs are way stronger in areas where the reward
| function is well known, such as exploiting - you break the
| security, you succeed.
|
| It's much harder to establish whats a usable and well
| architected, novel piece of software, thus in that area, progress
| isn't nearly as fast, while here you can just gradient descent
| your way to world domination, provided you have enough GPUs.
___________________________________________________________________
(page generated 2026-04-07 23:00 UTC)