Kevin Beaumont22h ago
I’ve had a bunch of people ask my thoughts on Anthropic’s Mythos. I’ve read the research paper they released and the numbers, and basically I agree with @malwaretech’s take. It’s marketing. The cybersecurity industry is historically very good at marketing cyber pearl harbour and the need to buy magic boxes.
Show threadKevin Beaumont22h ago
Companion video https://youtu.be/fM7GIIylXqI
Is Cybersecurity Over?

YouTube
Show threadKevin Beaumont21h ago

I don't think anybody actually watches videos any more, so here's MWT's core point -

The flagship and lead vuln in the research is a BSD vuln, it cost $20k to discover with Mythos. Anthropic only reached a crash, and the vuln class in 99%+ cases never reaches RCE, just crashes.

So.. cool.. you spent $20k of VC money to find a crash as the flagship vuln. But... uhm... that isn't the end of the world.

The proof is going to be if any of the open source vulns turn out to be important. So far:

Show threadKevin Beaumont21h ago

Anthropic set the project across open source projects and provided access and reported the vulns. Typically, you'd expect to see NCSCs spinning up advisories to patch high impact vulns, CISA telling orgs to patch etc etc etc.

What's actually happening is... uhm... a whole heap of nothing but people copy and pasting marketing about how cybersecurity is over.

It's not though, is it?

Show threadMarius Kießling
@GossiTheDog Even *if* the word prediction box is now capable of findings vulns by throwing massive compute at the problem (leaving all the problems with this aside), you still need to get people to fix their shit. Like have they ever looked at what it takes to get a company to just patch their god damn network edge devices?
Apr 12 at 2:25pmWeb
Show threadNicole Parsons14h ago

@marius @GossiTheDog

In my observation, organizations use these PR announcements & media releases to do layoffs, so they can outsource to a nephew's startup or grandchild's consultancy.

And the necessary patches or policy changes never get implemented.

Show threadMarius Kießling14h ago
@Npars01 from experience, we can even leave out the nepotism and just trace it back to incompetence within the management team