GoKawiilClaude AI developer Anthropic made headlines this week for its development and internal release of a new model known as Mythos. This mythically-named AI model allegedly has incredible capabilities, including finding bugs and vulnerabilities in various apps, operating systems, browsers, and legacy software. Enough that Anthropic was concerned about its general release and will instead keep it internal and focus on working with major tech companies and governments to prevent this tool from falling into the wrong hands, where it could cause untold mayhem.
That's the pitch in Anthropic's blog and verbose 250-page report on the model — which includes over 20 pages of Anthropic staff waxing lyrically about their novel impressions of the new model and its "fondness for particular philosophers."
Alongside the repeated suggestions from Anthropic and its staff that we should be concerned, nay, terrified, of what AI like Claude Mythos can do, they repeatedly suggest they're unsure if this new AI is conscious.
Article continues below
For the record, it is not. It might be good at finding vulnerabilities in software, but many of them aren't as potentially damaging as Anthropic wants us all to believe.
Exploit hunting
The big "Project Glasswing" blog post and report on Mythos from Anthropic claimed its new model had found "thousands of high-severity vulnerabilities," which is indeed big news. Those bugs were said to be across every major operating system and web browser, and in some cases have been there for decades.
But it's not clear how realistic these vulnerabilities are, how many of them aren't actually exploitable, or even how problematic they are.
In the case of the FFMPeg vulnerability that has existed for 16 years, Anthropic's own analysis of the release suggested "This bug ultimately is not a critical severity vulnerability," and "would be challenging to turn this vulnerability into a functioning exploit."
Mythos reportedly found several potential exploits in the Linux kernel, but was unable to exploit any of them because of Linux's defense-in-depth security systems. A number of the exploits had also been recently patched, too, making it rather confusing why they were included in the total.
... continue reading