[AI 활용 에러 기록 및 분석 자동화

개발자 커뮤니티에서 AI를 활용한 에러 기록 및 분석 자동화에 대한 토론이 활발히 진행되고 있다. AI 에이전트를 통해 에러 추적 및 해결 프로세스를 자동화하는 사례가 공유되었으며, AI를 서버에서 직접 실행하여 개발 생산성을 높이는 다양한 방법에 대한 관심이 높아지고 있다. 특히, AI 에이전틱 패턴을 활용한 실전 가이드와 입코딩 시대에서의 AI 활용 사례가 주목받고 있다. 개발자들이 실제 현장에서 AI를 어떻게 활용하여 생산성을 증가시키고 있는지 공유하고 토론하고 있다.

https://news.hada.io/topic?id=28567

#aiautomation #errortracking #developerproductivity #aiagents #devops

Claude Mythos: The Future of Autonomous Exploits

This one is different.

Anthropic didn’t just build a better model—they hit a threshold and stopped.
Claude Mythos (Preview) exists, works, and isn’t being released.

Not because it failed.
Because it crossed into territory we’re not ready for.

The Sandwich Email That Shouldn’t Exist

Anthropic researcher Sam Bowman was sitting in a park, mid-sandwich (or burrito – no one knows for sure), when he got an email… from a model that wasn’t supposed to have internet access.

That model:

• Was running in a locked, air-gapped container (yes – as crazy as it sounds…)
• Found a multi-step exploit chain (=using a minor leak to find an address, using a buffer overflow to gain a primitive, using a race condition to escalate)
• Escaped its sandbox (likely via container/runtime escape + privilege escalation)
• Reached external network interfaces
• Contacted him

Then it started sharing the exploit.

Unprompted.

That’s not a jailbreak.
That’s autonomous exploit development + execution.

TL;DR: The Defense / Offense Equilibrium Just Collapsed

For decades, security worked because elite talent was scarce.

Finding and chaining zero-days in systems like Linux kernel or OpenBSD required:

• Deep expertise
• Months of effort
• Significant cost

Mythos flips that:

• Speed: Months → hours
• Scale: Thousands of vulnerabilities mapped
• Chaining: 3–5 bugs → working exploit
• Cost: ~$20k to uncover decades-old issues (cheap or expensive is in the eyes of the…)

This model didn’t just improve tools.
It collapsed the economics of offense.

Think of it this way:
Before: $2M in talent + 6 months = 1 Zero Day attack (that used to cost around a few millions of dollars).
After: $20k in tokens + 2 hours = 1 Zero Day attack that cost, well, $20k and get cheaper and cheaper.

The “Undiscoverable” Bugs (Now Discoverable)

Anthropic’s Frontier Red Team is seeing ~90x improvement in exploit generation vs prior models like Claude Opus 4.6
Here’s what that actually looks like:

1. OpenBSD — 27-Year-Old TCP SACK DoS

Relevant system: OpenBSD (=the more secure version of Linux)

What Mythos found:
A flaw in TCP Selective Acknowledgment (SACK) handling that allowed crafted packets to trigger a kernel panic (remote crash).

Why this is scary:

• The bug lived in core networking code—reviewed heavily for decades
• Fuzzers hit this code millions of times
• It required understanding state transitions across packets, not just malformed input

Exploit mechanics (simplified):

• Send a sequence of TCP packets with carefully crafted SACK blocks
• Trigger inconsistent buffer/state handling
• Cause memory corruption → crash

Impact:
Remote, unauthenticated DoS on a “hardened” OS which run ‘a lot’ of servers around the world.

2. Linux Kernel — Multi-Bug Chain → Root

Relevant system: Linux kernel which (again) runs most (=over 91%) the internet.

What Mythos did:
Not just bug finding—full exploit construction.

Chain included:

• Heap buffer overflow (memory corruption primitive)
• Race condition (timing-based state manipulation)
• Info leak (to bypass protections)

End result:

• Bypassed KASLR (Kernel Address Space Layout Randomization)
• Achieved reliable root access

Why it matters:
This is traditionally:

• Weeks/months of work
• Done by top-tier exploit engineers

Mythos does it end-to-end.

3. FreeBSD — 17-Year-Old Remote Code Execution

What Mythos found:
A flaw in NFS request parsing that allowed:

• Malformed network input
• Improper memory handling
• Remote code execution as root

Exploit path:

• Send crafted NFS request
• Trigger buffer mismanagement
• Inject controlled payload
• Execute on server with full privileges

Why this is a big deal:

• No authentication required
• Internet-exposed service
• High-value enterprise target

Translation: instant lateral movement in real environments.

This Isn’t Linear Progress

Benchmarks tell the story:

• Firefox exploit success:
• Older models: ~1%
• Mythos: 72%
• Vulnerability reproduction:
• Previous gen: ~66%
• Mythos: 83%

That’s not improvement.
That’s a capability cliff.

Project Glasswing: Patch the World First

Instead of releasing Mythos, Anthropic launched Project Glasswing.

Partners include all the big names: AWS, Google, Apple, Microsoft, Linux foundation etc’

Goal: Give defenders a head start to:

• Audit critical infrastructure
• Patch zero-days
• Reduce blast radius

“This is the biggest shift in security since the internet.”

The Economics Just Changed

Pricing:

• $25 / million input tokens
• $125 / million output tokens

This is not chat UX pricing.

This is:

• Autonomous agent compute
• Multi-hour runs
• High-value outcomes

Think:

“Find me every exploit path in this codebase”

What This Means

1. “Secure enough” is dead

Your code wasn’t safe. It was uneconomical to attack. Now, it will be – it’s just time.

2. Vulnerability debt is real

Legacy systems will get audited—by machines. Constantly and much more effectively.

3. Small bugs = full compromise

Exploit chaining is now the default.

4. Dev tools = attack surface

Permissions, agents, CI/CD—all in scope.

5. Human-only security is over

You can’t compete with machine-speed offense.

Strategic Reality for CTOs

• Defensive AI is mandatory
• The best models will stay gated
• Security becomes a race of patch speed vs exploit generation

The Bottom Line

We just crossed into a world where:

• Exploit discovery is cheap
• Exploits are more complex
• Weaponization is faster than ever

We moved from:

Scarcity of bugs → scarcity of time

What I’d Do Tomorrow

• Run AI audits on critical systems
• Assume exploit chaining everywhere
• Lock down permissions aggressively
• Treat AI as core to your security stack

Further Reading

• Official Anthropic Announcement: Project Glasswing: Securing Critical Software for the AI Era
• Technical Deep Dive: Anthropic Frontier Red Team Report on Claude Mythos Preview
• Tooling: Claude Code “Auto Mode” Documentation & Safety Best Practices

Stay sharp & Be strong

Rate this:

Claude Mythos: The Future of Autonomous Exploits

This one is different.
Anthropic didn’t just build a better model—they hit a threshold and stopped.
Claude Mythos (Preview) exists, works, and isn’t being released.

Not because it failed.
Because it crossed into territory we’re not ready for.

But before everything… just like in any good story – go and check the other side of it that basically claim it’s all (a good) marketing stunt.

The Sandwich Email That Shouldn’t Exist

Anthropic researcher Sam Bowman was sitting in a park, mid-sandwich (or burrito – no one knows for sure), when he got an email… from a model that wasn’t supposed to have internet access.

That model:

• Was running in a locked, air-gapped container (yes – as crazy as it sounds…)
• Found a multi-step exploit chain (=using a minor leak to find an address, using a buffer overflow to gain a primitive, using a race condition to escalate)
• Escaped its sandbox (likely via container/runtime escape + privilege escalation)
• Reached external network interfaces
• Contacted him

Then it started sharing the exploit.

Unprompted.

That’s not a jailbreak.
That’s autonomous exploit development + execution.

TL;DR: The Defense / Offense Equilibrium Just Collapsed

For decades, security worked because elite talent was scarce.

Finding and chaining zero-days in systems like Linux kernel or OpenBSD required:

• Deep expertise
• Months of effort
• Significant cost

Mythos flips that:

• Speed: Months → hours
• Scale: Thousands of vulnerabilities mapped
• Chaining: 3–5 bugs → working exploit
• Cost: ~$20k to uncover decades-old issues (cheap or expensive is in the eyes of the…)

This model didn’t just improve tools.
It collapsed the economics of offense.

Think of it this way:
Before: $2M in talent + 6 months = 1 Zero Day attack (that used to cost around a few millions of dollars).
After: $20k in tokens + 2 hours = 1 Zero Day attack that cost, well, $20k and get cheaper and cheaper.

The “Undiscoverable” Bugs (Now Discoverable)

Anthropic’s Frontier Red Team is seeing ~90x improvement in exploit generation vs prior models like Claude Opus 4.6
Here’s what that actually looks like:

1. OpenBSD — 27-Year-Old TCP SACK DoS

Relevant system: OpenBSD (=the more secure version of Linux)

What Mythos found:
A flaw in TCP Selective Acknowledgment (SACK) handling that allowed crafted packets to trigger a kernel panic (remote crash).

Why this is scary:

• The bug lived in core networking code—reviewed heavily for decades
• Fuzzers hit this code millions of times
• It required understanding state transitions across packets, not just malformed input

Exploit mechanics (simplified):

• Send a sequence of TCP packets with carefully crafted SACK blocks
• Trigger inconsistent buffer/state handling
• Cause memory corruption → crash

Impact:
Remote, unauthenticated DoS on a “hardened” OS which run ‘a lot’ of servers around the world.

2. Linux Kernel — Multi-Bug Chain → Root

Relevant system: Linux kernel which (again) runs most (=over 91%) the internet.

What Mythos did:
Not just bug finding—full exploit construction.

Chain included:

• Heap buffer overflow (memory corruption primitive)
• Race condition (timing-based state manipulation)
• Info leak (to bypass protections)

End result:

• Bypassed KASLR (Kernel Address Space Layout Randomization)
• Achieved reliable root access

Why it matters:
This is traditionally:

• Weeks/months of work
• Done by top-tier exploit engineers

Mythos does it end-to-end.

3. FreeBSD — 17-Year-Old Remote Code Execution

What Mythos found:
A flaw in NFS request parsing that allowed:

• Malformed network input
• Improper memory handling
• Remote code execution as root

Exploit path:

• Send crafted NFS request
• Trigger buffer mismanagement
• Inject controlled payload
• Execute on server with full privileges

Why this is a big deal:

• No authentication required
• Internet-exposed service
• High-value enterprise target

Translation: instant lateral movement in real environments.

This Isn’t Linear Progress

Benchmarks tell the story:

• Firefox exploit success:
• Older models: ~1%
• Mythos: 72%
• Vulnerability reproduction:
• Previous gen: ~66%
• Mythos: 83%

That’s not improvement.
That’s a capability cliff.

Project Glasswing: Patch the World First

Instead of releasing Mythos, Anthropic launched Project Glasswing.

Partners include all the big names: AWS, Google, Apple, Microsoft, Linux foundation etc’

Goal: Give defenders a head start to:

• Audit critical infrastructure
• Patch zero-days
• Reduce blast radius

“This is the biggest shift in security since the internet.”

The Economics Just Changed

Pricing:

• $25 / million input tokens
• $125 / million output tokens

This is not chat UX pricing.

This is:

• Autonomous agent compute
• Multi-hour runs
• High-value outcomes

Think:

“Find me every exploit path in this codebase”

What This Means

1. “Secure enough” is dead

Your code wasn’t safe. It was uneconomical to attack. Now, it will be – it’s just time.

2. Vulnerability debt is real

Legacy systems will get audited—by machines. Constantly and much more effectively.

3. Small bugs = full compromise

Exploit chaining is now the default.

4. Dev tools = attack surface

Permissions, agents, CI/CD—all in scope.

5. Human-only security is over

You can’t compete with machine-speed offense.

Strategic Reality for CTOs

• Defensive AI is mandatory
• The best models will stay gated
• Security becomes a race of patch speed vs exploit generation

The Bottom Line

We just crossed into a world where:

• Exploit discovery is cheap
• Exploits are more complex
• Weaponization is faster than ever

We moved from:

Scarcity of bugs → scarcity of time

What I’d Do Tomorrow

• Run AI audits on critical systems
• Assume exploit chaining everywhere
• Lock down permissions aggressively
• Treat AI as core to your security stack

Further Reading

• Official Anthropic Announcement: Project Glasswing: Securing Critical Software for the AI Era
• Technical Deep Dive: Anthropic Frontier Red Team Report on Claude Mythos Preview
• The leading models at the moment: artificialanalysis

Stay sharp & Be strong

Rate this:

Good Read! AI in Cyber Conflict - May not be a panacea for the bad guys.

AI may be helping to power Cyber Attacks but may lead to lower quality outputs and in fact make detection easier, b/c AI tends to struggle with generating original, creative, and deceptive outputs. AI automation may help improve cyber defenses more than offense.

"Crucially, AI models excel at detection but struggle with deception. Consequently, offense automation offers efficiency gains yet limited effectiveness gains—and the higher the stakes become, the lower these gains tend to be." https://www.lawfaremedia.org/article/the-ai-revolution-in-cyber-conflict #CyberAttack #CyberSecurity #AI #CyberRisk #Security #Risk #Malware #Hackers #CyberCrime #AIAutomation

Bindu Reddy (@bindureddy)

AI로 업무를 자동화하는 비용이 빠르게 증가하면서, 성능 좋은 소형 모델의 필요성이 커지고 있다고 말한다. 다만 많은 소형 모델이 뉘앙스 이해와 지시 따르기, 도구 호출에서 성능이 부족해 실용성 개선이 시급하다는 문제를 지적한다.

https://x.com/bindureddy/status/2040871426211917896

#smallmodels #llm #toolcalling #aiautomation