There's no legal mechanism for the president or the government at all to do that.
If Glasswing has been started years ago with the goal of applying fixes to AI-found gaps, then this would just be another model to add to that effort. But doing so in the ominous shadow of some new super model boosts panic IMO.
This initiative probably could have started a few months sooner with Opus and similar models, though.
Evidently they tried and even the most recent Opus 4.6 models couldn't find much. Theres been a step change in capabilities here.
Mythos certainly represents a big increase in exploitation capability, and we should have anticipated this coming.
I know of two F100s that already started using foundation models for SCA in tandem with other products back in 2024. It's noisy, but a false positive is less harmful than an undetected true positive depending on the environment.
However, no single model of those could find everything that was found by Mythos.
https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jag...
Nevertheless, the distance between free models and Mythos is not so great as claimed by the Anthropic marketing, which of course is not surprising.
In general, this is expected to be also true for other applications, because no single model is equally good for everything, even the SOTA models, trying multiple models may be necessary for obtaining the best results, but with open weights models trying many of them may add negligible cost, especially if they are hosted locally.
Common recklessness obviously include devs running binaries on their work machine, not using basic isolation (why?), sticky IP addresses that straight-up identify them, even worse, using same browsers to access admin panels and some random memes, obviously, hundred more like those that are ALREADY solved and KNOWN by the developers themselves. You literally have developers that still use cleartext DNS (apparently they are ok with their history accessible by random employees outsourced)
I've seen a bunch of people conflate the Claude Code source-map leak with the Mythos story, though not quite as blatantly as here. I'm confident that they are totally unrelated.
Also I’d like to believe that this really is such a huge step forward compared to Opus, but lately I’ve found it hard to believe when I look at the statements made by the CEOs of AI companies and their associates, who are fuelling the hype surrounding this topic even further. Of course, it is good that large companies and industries that are crucial to the country are the first to have access to this, but until the launch takes place, I will approach this with a degree of scepticism.
PedroBatista•1h ago
I'm sure it's a great big model, but the level of hype and dishonesty is something out of Sam Altman's book.
Of course it's because of the upcoming IPO, but that's the end game, for now it's critical to get those private equity guys and bank institutions to believe the gospel and hold the bag, only then the suckers from the secondary markets will be allowed to be suckers too.
reducesuffering•42m ago
colechristensen•38m ago
Historically bad security that people just got by with matched with powerful tools that aren't any better than the best people, but now can be deployed by mediocre people.
SpicyLemonZest•22m ago
alephnerd•34m ago
This. 100% this.
A large portion of the industry is under NDA right now, but most of the F500 have already already deployed or are deploying foundational models for AppSec usecases all the way back in 2023.
Sev1 vulns have already been detected with older foundation models.
Of course the noise is significant, but that's something you already faced with DAST, SAST, and other products, and is why most security teams are also pairing experienced security professionals to adjudicate and treat foundation model results as another threat intel feed.
colechristensen•40m ago
icedchai•36m ago
bwfan123•26m ago
It is great to be in a "best-effort" business where there are no consequences for bad things happening. Cybersecurity is one of those businesses. Web search, feeds and ads are another.
Imagine you are selling locks to secure homes. A thief breaks the lock. The lock-maker is not held liable. In fact, they now start selling stronger locks, and lock sales actually improve with more thefts.
SpicyLemonZest•18m ago
guzfip•1m ago
Still probably a benefit depending on your philosophy.
downrightmike•1m ago