US Cyber Agency Is Using Anthropic's Mythos To Audit Government Code (yahoo.com) 20
CISA is reportedly using Anthropic's Mythos model to scan government code repositories for security vulnerabilities, with sources saying the audits have already found numerous bugs. Reuters reports: The scanning is being done by CISA's Attack Surface Evaluation team, according to one of the sources. The team is a group within CISA that conducts digital security assessments and hacking exercises across government. Two of the sources said the audits had already uncovered a large number of vulnerabilities but did not elaborate. Reuters could not establish exactly how much government code the team had gone through or the nature or severity of the bugs it discovered.
[...] The National Security Agency, the U.S. government's powerful eavesdropping agency, has been using Mythos as far back as April despite the blacklist, Axios has reported. Late last month, the New York Times said that NSA analysts had been testing Mythos in classified settings and coming away impressed with its capabilities. But when Anthropic rolled out a public version of Mythos called Fable, which included what it described as cybersecurity safeguards, the White House suddenly demanded that it ban foreigners from running it. This triggered a global shutdown of the model that was lifted only last week.
[...] The National Security Agency, the U.S. government's powerful eavesdropping agency, has been using Mythos as far back as April despite the blacklist, Axios has reported. Late last month, the New York Times said that NSA analysts had been testing Mythos in classified settings and coming away impressed with its capabilities. But when Anthropic rolled out a public version of Mythos called Fable, which included what it described as cybersecurity safeguards, the White House suddenly demanded that it ban foreigners from running it. This triggered a global shutdown of the model that was lifted only last week.
ok (Score:2)
When it comes to hacking, these AIs are like really, really advanced/amazing fuzzers.
Re: (Score:2)
Indeed, they take needles in haystacks and make smaller haystacks that have some of the needles. They don't catch some things and they falsely flag a lot of things, but they do either directly or get close to something.
One issue in our codebase that was caught was pretty much spot on. Now upon it being highlighted, it was obvious to anyone that the inexperienced developer screwed up, problem was no one had the attention span to notice. The other issue close to real that it caught was actually not the fla
Re: (Score:2)
Fine, except now we are inundated with false positives because the LLM indicates something,
There's a solution to this problem, alluded to in your sig.
LLMs are like violence. If they don't solve the problem, use more. Simply tell the LLM to check which bug reports are false positives.
Re: (Score:2)
Don't forget to use an LLM to identify the false negatives that you get when you check for false positives....
I agree. I too wish I was entirely joking. I don't even dare to put a sarcasm tag on the comment.
Re: (Score:2)
Re: (Score:2)
There's also supposed to be a training loop with LLMs,
Re: (Score:2)
That is less stupid then one might think. Tell it to find a bug, then tell it there are still bugs in the code and look if it finds another one. LLMs tend to believe the user (they are programmed, as no user wants a tool to object to a request) so it WILL find another one. If you continue too often you start getting false positives, but until then the things might find a few more bugs the first iteration missed. You first get the low hanging fruit, and need to push more for the rest.
Re: (Score:2)
It's basically shaking the magic 8 ball and it works, but it's totally a judgement call when it has worked 'enough'. It doesn't necessarily progress from easiest to hardest issues to find, it just is a bit random. Hard to say how many passes before you've *probably* got the real ones. My experience has not been that false positive rate increases, sometimes you might have all false positives but a continuation will flag real issues.
Re: (Score:2)
It is a pretty terrible combination of skills.
Good at making faulty insecure code and good at finding exploits.
The perfect combination to make any sort of "i gonna fire everyone and replace it with vibe code" plans be even worse.
Of course (Score:3)
Obviously it is a powerful tool (even when it is overhyped) and other than usual users, they can ensure the privacy of what they upload using an NSL. Anthropic won't be that stupid to mess around with US agencies when Trump can just buy OpenAI services instead.
Re: (Score:2)
Nah. Trump already had some deals with OpenAI. Anthropic may be a bit better (hard to tell exactly) but they are pretty replaceable. In particular when Trump starts to really favor OpenAI and deny Anthropic offering their high-end models to anyone. They learned it the hard way once, will they try the same again?
A lot of taxpayer money to cause more problems (Score:1)
That is a lot of taxpayer money going to pay AI companies for something the government was supposed to be doing all along.
They are also using unproven technology to audit classified resources, technology that has already been shown to be vulnerable to leaking sensitive data.
Re: (Score:2)
Unproven? This is the technology directly responsible for the onslaught of zero-day exploits in every major F/OSS (and even some closed source) ecosystems all over the internet. Go check the CVE news from the past couple months, its all Mythos up and down entirely. This is literally the tool cracking every major codebase on the internet, so calling it "unproven" is a bit of a stretch at this point.
I Thought Anthropic Was off Limits (Score:2)
Didn't Anthropic get banned from government use because they wouldn't change their contract terms for Segseth?
Trust (Score:2)
I use clang to compile C and C++ code (Score:2)
Why not use an llm to audit code?
Maybe they should use a lot of LLMs, get second and third and fourth oppinions.
Or is the article making a point that the US government is limiting themselves to one llm and if you want to hack the government, you just need to find Mythos's weaknesses?