I received 9 reports of Fil-C issues from Anthropic

All of them were real bugs. None of them were false positives.

The quality of the reports was exceptional. (My baseline is doing security defense on a browser engine, so my baseline has a large sample count and is probably representative of what experts are capable of.)

The quality of the proposed fixes was alright. I took some of the fixes verbatim. I used most of the fixes as significant inspiration for doing it my way.

The quality of the test cases was exceptional.

Maybe I’m special somehow! But I just want to call out the enormous chasm between what I saw of anthropic’s capability and what TFA says

As someone working at a bigtech co that has spent every single working day (and many weekends) since the launch of Mythos patching serious, company-ending type of security issues, these types of posts really irk me.

Public datasets of CVEs being underwhelming doesn't mean much if all of the issues are in private company codebases that will never get a CVE number assigned and will never get a fancy blog post. You're never going to hear about them, and the people working on them probably can't tell you about them, but that doesn't mean they don't exist.

We're all worried about OSS having security issues because of how widely used things like PHP or curl are... but the same can be said about email providers, document collaboration SaaSes, payment processors, etc that millions of companies depend. Those companies will never be in datasets like this, and they'll never publicly disclose how many issues they found.

The PHP2Shell vulnerability ended up being paradoxically comforting for me.

They turned frontier models loose on PHP, and the big one they found was based on a previously known logic flaw that was extremely difficult to exploit. Which makes sense: hence the need for frontier models.

And in the wild, while there have been many attempts and a few simple demo successes, the practical impact has seemed to be small, seemingly constrained by the length of the chain and the diversity of PHP configs.

In short, it was indeed a major vulnerability, but not magic (in the Arthur C Clarke sense).

I think ultimately the fear comes down to: do you believe that code can be secured. I recognize that there is probably no objective way to deductively prove it because of the Halting Problem etc. But if one believes code can be constructed to operate to spec, then there must be a limit to the damage an LLM can do, even a very smart one.

I think we are going through a phase where a lot of known triaged code shortcomings will get exposed and hopefully fixed. Sucks while it is happening. But not actually the first round of this type of evolution. And ultimately I think as before, we will come out the other side with more secure and durable technology.

The blog is misleading because it tries to characterize Project Glasswing's effectiveness through use of a tangentially related data source. A Project Glasswing vulnerability discovery most often occurs when a Glasswing partner points a Mythos-class model at its own, often proprietary, software. The data source (aka "ledger") is only for the Anthropic coordinated vulnerability disclosure program for open source software: in other words, Anthropic itself pointing a Mythos-class model at an OSS package, and then notifying the maintainer afterward that it had done this, and had findings to share. This OSS work is certainly useful, but the number of fixes reflects - in part - limited time availability by volunteer OSS maintainers, and Anthropic sometimes working without knowledge of the OSS project's threat model (the threat model is explicitly requested in the newer oss-scanner effort). Percentage fixed is often much higher for use of Glasswing with proprietary software, e.g., https://blog.cloudflare.com/cyber-frontier-models/ "Our research with Mythos Preview was conducted in a controlled environment against our own code; every vulnerability surfaced through this work was triaged, validated, and remediated where action was needed under Cloudflare's formal vulnerability management process."

There's an anecdote about curl, but I'm not sure if there's enough in here to draw conclusions from. 20% of vulnerabilities have been made public, and many of those are marked as "withdrawn" or "duplicates". However, it's unclear whether the remaining 80% have not been made public because they're not fixed or real. In other words, this is analysis of survivors (public); not much can be said about those still under embargo.

> So far, only 2 of the 442 have been exploited in the wild, just 0.45%.

> almost none are being exploited

Isn't the whole point of glasswing to patch stuff way before it can be exploited? If the patched code is distributed quickly- there's no opportunity (or incentive) for bad actors to craft and distribute an exploit. This reads like an attempt to spin them as not being "real" vulnerabilities.

It is bad if this points to a general pattern of AI being better at finding than fixing vulnerabilities. The larger that ratio, the harder to secure all the things. The current stat from this experiment is 37,966 to 217. Lots of false positives, but not enough to change the big picture. I hope they didn't apply equivalent tokens to both sides, or AI may be better at demolition than construction.

As someone downstream of the company in the posting, i can confirm the tsunami of AI generated vulnerability reports. And so thr human maintainers are stretched even thinner, and most of the bugs dont matter.

The good thing is the push towards an exploitability rating: If you have a vulnerable piece of software on your system, but it isnt running, it isnt critical.

> Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been marked fixed.

So the article is making a sweeping statement based on the 19.4% of publicly disclosed CVEs?

That statistic suggests the opposite. I'm sure government is aware of many back doors they keep secret and prefer them to remain secret.

This is very much inline with Greg Kroah-Hartman the long-time Linux kernel maintainer's view Anthronpic's Mythos audacious claims its cyber capability. Majority of those "findings" were way out of proportion and merely "pattern matching" previously discovered methods of exploitation.

[1] https://news.ycombinator.com/item?id=50342622

[2] https://news.ycombinator.com/item?id=49929391

The post seems misguided or misdirected in my opinion. Not discounting the fact that the frontier models may find existing bugs, that some are labelled at the incorrect level, even some being a non-bug -- fact remains they are discovering vast numbers of issues. It also isn't the job of Anthropic or OpenAI to fix everyone's bugs, they are doing everyone a courtesy to spend their time identifying them in the first place. The bigger issue appears to be that they are finding more bugs than the developer capacity to can address.

Does anyone know how Glasswing relates (quality-wise) to https://github.com/anthropics/oss-scanner ?

As AI gets better, it feels more and more like each person gets to hold a bomb in their own hand, but at the same time it feels like having a bomb that can just go off in that hand.

In my opinion, what tells a lot about AI provider AGI claims versus reality is the difficulty to have LLM provide the fix to issues.

For PHP2shell vulnerability for example, there was "patched" .deb (and equivalent) packages only for the most recent and most trendy distributions but countless older versions of distributions and php versions were like abandoned without simple solution. I would have guess that "patches" and pre-built fixed packages would be flooding the world. And with just a prompt of one line, most servers would be properly patched. But no.

Sankey diagrams are ruined for me

Well in cases like these, it’s not the many that matter, but the few. Measuring in aggregate is not conclusive.

> made me wonder whether this was more of an overhyped marketing campaign.

This is the entire premise of LLM hype wave. Or any overhyped tech that tries to force its way into every aspect of life.

Very interesting that the conclusion of the article is so tightly aligned with the VulnCheck's business model! It's almost as if this is just a thinly veiled advertisement...

> The CVEs are a sliver of this year's total, almost none are being exploited, fixes have stalled while duplicates and withdrawals pile up, and the triage burden is shifting onto the open source maintainers Glasswing promised to help. The receipts keep coming in. They still don't reconcile.

> VulnCheck is helping organizations not just to solve the vulnerability prioritization challenge - we’re working to help equip any product manager, CSIRT/PSIRT or SecOps team and Threat Hunting team to get faster and more accurate with infinite efficiency using VulnCheck solutions.

I think the most obvious chicken little sign has been that we've had no catastrophic exploits in the past year due these findings.

Sure LLMs have helped reduce the attack surface and we patch things faster too, but I was really expected a few more Supermarket-level bangers.

Hard not to draw parallels with Deepmind’s GNoME project which found millions of new “materials” most of which turned out to already exist or be garbage basically.

https://pmc.ncbi.nlm.nih.gov/articles/PMC11044265/

The common thread is asking humans to do the verification work, which is the hard part.

This is literally an ad for a service that helps you prioritize vulns! It is incredible how often an alleged study like this turns out to be an ad for such a service. "Businesses finding ROI hard to demonstrate" -> ad for a product that helps you demonstrate ROI. Etc.

> VulnCheck is helping organizations not just to solve the vulnerability prioritization challenge - we’re working to help equip any product manager, CSIRT/PSIRT or SecOps team and Threat Hunting team to get faster and more accurate with infinite efficiency using VulnCheck solutions.

My AI Maxxer team mate gets politely ignored now when they put up a bunch of completely random, irrelevant "findings" on my PRs. Probably some model like Fable 85.2.12 can find every nuanced "gap" in my dev-env-only shell script, but I'm not fixing that when there is no production impact and I'm trying to make merge the pipeline to make your containers work.

/Rant

I rather like how the folks squabbling about the stats about the report stockpile are ignoring the stats about OSS Scanner. [0] The >50% false positive rate for Curl agrees with Greg K-H's report from this year [1] of a very high false positive rate from Glasswing/Fable. And -as he mentioned in his talk- people refused to pay money for Qualys because its 20% false positive rate was way too high. The only way you're going to get folks to pay for Anthropic's vulnerability scanners is if they're either incapable of understanding the details about its performance or they don't give any fucks about saturating their bug-fixers with garbage reports.

[0] <https://www.vulncheck.com/blog/anthropic-glasswing-november-...>

[1] <https://www.youtube.com/watch?v=NnV_cWeoo5Q>

that's hilarious, they made such a big deal of the cyber scare

no moat

There was a lot of hype early this year. Mythos, openclaw, gastown. And now they’re basically completely irrelevant. Things move so fast.

Huh? Is VulnCheck talking about itself? I’ve come across many false CVEs associated with VulnCheck over the past few months, including this one: https://github.com/advisories/GHSA-vfj7-8cjw-p6xm

Expected this to happen maintainers overloaded with issues majority of which are nothing burgers.

And yet every single company is getting hacked. So some of the findings (presumably non-Glasswing) are clearly quite whelming!

The biggest problem is that AI boosters will of course raise their adhoc evidence and they are fucking loud. The same people who insist there's no need to review code because it doesn't need review. But, fuck. How do they are so sure about that if they don't review, it is just circular thinking over and over again.

[dead]

Does the author expect that every company using Glasswing/AI is going to credit the AI directly? I would not expect Microsoft or Cisco to credit Anthropic if one of their internal teams uses AI to discover a CVE in their code.

AI models generating slop findings? Who ever could have predicted this?!