alt Hacker NewsAs someone working at a bigtech co that has spent every single working day (and many weekends) since the launch of Mythos patching serious, company-ending type of security issues, these types of posts really irk me.
Public datasets of CVEs being underwhelming doesn't mean much if all of the issues are in private company codebases that will never get a CVE number assigned and will never get a fancy blog post. You're never going to hear about them, and the people working on them probably can't tell you about them, but that doesn't mean they don't exist.
We're all worried about OSS having security issues because of how widely used things like PHP or curl are... but the same can be said about email providers, document collaboration SaaSes, payment processors, etc that millions of companies depend. Those companies will never be in datasets like this, and they'll never publicly disclose how many issues they found.
Replies
If $company has had enough "company ending” security issues to keep you busy every work day for the past 5 months since mythos release then maybe said company shouldn't be in business to begin with? Clearly they cannot have taken security serious in any way shape or form.
With code public many of the actively used and maintained open source projects have better code quality than proprietary or big MNC ones. Forget Mythos level models but even smaller models are able to find large number of issues in closed source tools in my example. One reason obviously is the peer review and quality checks by users/hackers/maintainers over the years.
Possible you might be believing the LLM too much. It seems to flag so many “critical, company ending” security issues, the ones surviving any semblance of scrutiny I’d estimate at 0.5%.
Make sure you’re still thinking.
Have you seen any patterns for the causes of the error you have seen? For example, more training for developers? Or maybe just systems were really very complex that led to bugs?
I'm sorry you've possibly been wasting your time, but this lends little credence to the idea that what you've been patching has actually mattered from a security perspective.
If there isn't data available to assess impact objectively, then this is just fluff and nobody has any reason to believe you.
I am unaware of any comprehensive analysis demonstrating that LLMs can identify and exploit problems in private code repositories for major enterprises any more than they do open source technologies, or that this is a growing/mounting crisis. Are you?
The OP gives us substantive reason to believe that Glasswing is fluff propped up by fake metrics, which confirms the suspicions of many people working in the trenches with the technology. I don't know what you're giving me reason to believe.
as a bystander not even working in the sector, your witnessing is exactly what I was worried for. if an agent is wily enough to defeat a security it should also be wily enough to cover its tracks, otherwise what's the point?
Yeah I am much more worried about some critical vulnerability in, say, the controller logic for pumps at sewage treatment facilities vs. a sandbox break in Chrome (which will be patched well before the blog post...). The broad issue is that you can turn DeepSeek-v6-unhinged loose on an arbitrary IP and exploit ~everything that is not developed and actively maintained by a billion-dollar company