Post

👍

I keep repeating this -- EVEN IF I TAKE ANTHROPIC'S MARKETING AT FACE VALUE, Mythos just continues the trend lines of "More CVEs" and "Faster Time to Exploit (...a small percentage of vulnerabilities". We already know how to defend against these things. It's just a lot of work.

first thing i'd lock down is DB perms. a prod role without DROP or ALTER plus point-in-time restore turns the 9-second delete class into a noisy failed migration instead of a wipe. do you expect the first wave here from over-privileged agents, or from CI secrets getting reused everywhere?

Way better than our position. We are currently discussing finding a vendor for "known safe code" without any conversations about the attack vectors that would compromise APIs that sit behind the firewall.

That plus figure out how to get customers pay for Claude tokens

It's nice to see this on our side of the pond: www.aisi.gov.uk/blog/our-eva...

Me too. Not easy to do but very worth the effort.

Oh, BGP…

Regardless, it's an incredible economic opportunity for LLM vendors. Whether you're a legacy s/w vendor or building all new; whether you're still writing s/w, using AI to build s/w or building AI solutions, every company will have to use LLMs to find security flaws as part of their SDLC pipeline

Not long ago I visited a recycling paper mill that ran a DOS-based system on one of the paper machines.

The bit about hacking the IP protocol is a bit overstated. But the fact that the rest is undeniably true is actually, IMHO, a great argument IN FAVOR of freaking out over Mythos.

Also, we could find them without needing a model that now uses several TB of RAM and 2-3 racks of compute per prompt. I mean, if I brought the weight of 1000 AWS instances on everyone's encrypted password, I could crack them, but no one is freaking out about that.

I’ve been in a training course this week (DCC assessor) it’s a useful reminder of how the majority of companies struggle with basic controls and risk management. The AI issue is its impact on CEOs who suddenly think they don’t need to recruit, pulling up the ladder for newcomers into the industry

Happily, the mobile phone provider that had unprotected directories on their servers called "lockbox" and "creditcard" (with contents going back years ;-) no longer exists. 😇

Have you seen this documentary? Very informative.

I made good money in the latter half of the 1990s remediating it. Starting in 1996.

I remember that there were Russian generals here and US generals there in the nuclear command centers to make absolutely sure there were no false alarms and no accidental escalations.

COBOL is a massive, massive problem. The bits of tech that aren't *Nix are COBOL, and fewer and fewer people know how to write it. Forget Mythos identifying CVEs at the speed of sound, train COBOL programmers.

To work in InfoSec you either need to be a healthy paranoiac , or you become one - or you don't make it.

I will absolutely agree with you hear. Said from day one that the fact that everyone's got multiple 5-year-old vulns they haven't patched means that Mythos isn't our biggest threat right now...

Hackers break the internet, no more hacking. It’s like a looney toons reverse gun where it’s pointed at the user Everyone leaves the gun alone

Assuming you’re still on XP due to hardware limitations, that’d be your first stop. MS can’t patch a Pentium. XP also has a monolithic kernel that can be freely modified at runtime. A compromised printer driver could pwn the system. Can’t patch that. You’d have to completely rewrite IE 6. Etc.

Technical limitations don't matter. It had the coolest wallpaper ever.

Me letting my skepticism of AI fight it out with my urge to panic while reviewing NIST controls:

Try working in a company doing cyber defense. The entire industry has lost their minds.

While I agree with you, I'm definitely using this convo to push the biz to have better patching windows and force IT to created systems that have been redundancy for these patching windows. This struggle is driven partially by vendors and partially by lack of investment in maintenance.

This whole thing about Mythos reminds me of when voice cloning was considered "too dangerous for public release" and now I can do it on my computer with a few clicks.

Are you shitting me right now?

You had me at water treatment... @craignewmark.bsky.social @neorsd.org @gate15.bsky.social

but muh engagement stats bro