Post

Several groups confirmed the same vulnerabilities can be found with Opus. So other than marketing stunt, by Anthropic giving away millions in compute for free in exchange for companies pumping it's "scary to release" model, what was it? Why didn't companies do this with Opus already?

That doesn't really mean anything - if you point Opus at the relevant files and ask to find the bug it'll find them, of course. Same for a human. It's conceivable that the model is particularly good by sheer virtue of not needing to know which files and interaction must be scrutinized.

0 reposts1 like

"of course" is very load bearing there. Did you read the bug reports? These are complex chains that span huge codebases and are difficult to reason about. These are not "find the bug in these 10 files" kind of bugs.

And Opus was able to do the same thing as Mythos - it was pointed at a project and asked to find vulnerabilities, while given an absolutely massive compute budget. Because that's the marketing trick - giving unlimited compute until it finds a bunch of holes. Existing models do just fine at that.

It still looks like newer model are less noisy and find less false positive. One other thing: the cat is out of the box anyway, so we need the defenders to use what's there. Because the attackers will anyway, and they are well funded.

That has been the case for decades. Attackers have always been state-sponsored. Defenders are randos on the internet who maintain load-bearing repos on GitHub. I understand that many are only now discovering how things are, but none of this is new.