Mastodawn

Kevin Beaumont 21h ago

I’ve had a bunch of people ask my thoughts on Anthropic’s Mythos. I’ve read the research paper they released and the numbers, and basically I agree with @malwaretech’s take. It’s marketing. The cybersecurity industry is historically very good at marketing cyber pearl harbour and the need to buy magic boxes.

Kevin Beaumont 21h ago

Companion video https://youtu.be/fM7GIIylXqI

Is Cybersecurity Over?

YouTube

Kevin Beaumont 20h ago

I don't think anybody actually watches videos any more, so here's MWT's core point -

The flagship and lead vuln in the research is a BSD vuln, it cost $20k to discover with Mythos. Anthropic only reached a crash, and the vuln class in 99%+ cases never reaches RCE, just crashes.

So.. cool.. you spent $20k of VC money to find a crash as the flagship vuln. But... uhm... that isn't the end of the world.

The proof is going to be if any of the open source vulns turn out to be important. So far:

Kevin Beaumont 20h ago

Anthropic set the project across open source projects and provided access and reported the vulns. Typically, you'd expect to see NCSCs spinning up advisories to patch high impact vulns, CISA telling orgs to patch etc etc etc.

What's actually happening is... uhm... a whole heap of nothing but people copy and pasting marketing about how cybersecurity is over.

It's not though, is it?

trademark 19h ago

@GossiTheDog They aren't claiming it's over, that's a strawman. But interestingly they are providing commit hashes of things they've found. Some of these are seriously scary. I've saved a copy of the webpage and will be waiting to see if the promised commits turn up. If they do check out my opinion of Anthropic will rise. If not...

Cassandrich 13h ago

@trademark @GossiTheDog What does "commit hashes of things they've found" even mean? No non-slop project is going to merge the same commits they used in their fixes, because they're LLM slop without provenance to license. If any of these are real, the upstream will fix the bug properly in a way the actual people working on the project understand and can document.

Andrew Zonenberg 13h ago

@dalias @trademark @GossiTheDog the hashes are of advisories they claim they will publish in the future afaik, not patches.

Andrew Zonenberg 13h ago

@dalias @trademark @GossiTheDog so easily verifiable if they actually turn up but the hype cycle will have moved on by then and they already got the PR benefit of claiming a huge number of bugs

@azonenberg @dalias @GossiTheDog I think it will be a big deal if they don't keep their promises. It's the sort of thing journalists will use for attack pieces. We do already know that some of the bugs are real, for instance Anthropic is keeping the exploit for CVE-2026-4747 secret, but somebody else used public version of Claude to create their own working exploit: https://blog.calif.io/p/mad-bugs-claude-wrote-a-full-freebsd

MAD Bugs: Claude Wrote a Full FreeBSD Remote Kernel RCE with Root Shell (CVE-2026-4747)

To our knowledge, this is the first remote kernel exploit both discovered and exploited by an AI.

Calif

Cassandrich 12h ago

@trademark @azonenberg @GossiTheDog I love how they hype what's a vuln in the in-kernel NFS server (FFS we've been doing this shit at least 2/3 of my lifetime, stop doing NFS/sunrpc shit already) as "FreeBSD RCE".

I knew when I was like 15 that you don't run NFS unless you want to get popped.

trademark 12h ago

@dalias @azonenberg @GossiTheDog To summarize your position: "If Anthropic witholds something to give defenders time to fix it, it means they're lying and have nothing. When they do release a real bug it means that it was for some stupid thing you shouldn't be running anyway." Got it.

Cassandrich 12h ago

@trademark @azonenberg @GossiTheDog Huh? Did your LLM just vomit that? Because it's completely unrelated to what I said.

What I said is that they're hyping a vuln in one small thing, an NFS server, that FreeBSD happens to have a version of that runs in kernelspace, that nobody security-conscious would be using to begin with, and calling it "vuln in FreeBSD!" to make it sound important and impressive.

Absolutely nothing to do with disclosure timeines or whether their findings are real.

trademark 12h ago

@dalias @azonenberg @GossiTheDog Let me try explaining more clearly: Anthropic does this to demonstrate the technical capabilities of their new model. Your denigration of the utility of the FreeBSD NFS-server does not detract from that in the slightest, so Anthropic and their customers are not going to care in the slightest. You're being rather insulting to FreeBSD though, is that intentional?

Cassandrich 11h ago

@trademark @azonenberg @GossiTheDog They do this to impress investors/C-suites and to keep the grift train going.

I'm not going to address any claims about whether the "technical capabilities of their new model" are a thing.

And to be impressive, yes, they need the thing they attack to be highly regarded in terms of its reputation for security and quality. "Vuln in NFS server module that runs on FreeBSD" does not impress. "Vuln in FreeBSD" does. And it's a lie.

I have no idea how you think this is "insulting to FreeBSD".

trademark 11h ago

@dalias @azonenberg @GossiTheDog You're saying nobody should run the NFS-server they are making. How is that not insulting? Why don't you go to their mailing lists and tell them to stop? For extra effect repeat the phrase you used: "I knew when I was like 15 that you don't run NFS unless you want to get popped."

Cassandrich 11h ago

@trademark @azonenberg @GossiTheDog I don't know the project dynamics of this NFS server module, but I doubt it's something core folks are proud of. NFS is basically a domain of meeting very old legacy requirements, and for old die-hard Sun fans who run it by choice. Back in the day it had utterly zero access control. You just told the server "hey, I'm root" and it said "ok, cool". AIUI the vuln here is in part of an authentication layer bolted on.

trademark 11h ago

@dalias @azonenberg @GossiTheDog You are being incredibly rude and even more ignorant. FreeBSD support latest NFSv4 including Kerberos encryption and authentication. if you don't believe me ask on the relevant mailing list. Though if you do I recommend you tone down your rudeness.

@trademark @dalias @azonenberg @GossiTheDog > How is that not insulting? Why don't you go to their mailing lists and tell them to stop?

"We know, it's for intranet-use only, in trusted network where you care more about performance than security between trusted peers" is the likely answer.

trademark 11h ago

@lispi314 @GossiTheDog @dalias @azonenberg That's not what they're saying though. From the wiki "krb5p
Kerberos authentication, integrity, and privacy. This is the most secure flavor of NFS. Not only does it provide authentication and integrity, but the entire RPC payload is encrypted. Thus a passive eavesdropper can see nothing but RPC headers. krb5p is a good choice for insecure networks, including wireless networks. "

@trademark @GossiTheDog @dalias @azonenberg Then whoever wrote that was:

a) Irresponsible
b) Basically copy-pasting press release material on NFS + Kerberos feature.

trademark 10h ago

@lispi314 @GossiTheDog @dalias @azonenberg Please direct your suggestions to the FreeBSD people directly, they are easily contactable.

Cassandrich 10h ago

@trademark @lispi314 @GossiTheDog @azonenberg We're not making technical recommendations for the FreeBSD team here. Anyone who actually has reason to use NFS knows the risks/tradeoffs and if they're choosing to use something that's going to get them popped that's on them, not on the FreeBSD team.

We're debunking hype that's intentionally exploiting the ignorance of people like yourself about what component was actually vulnerable and whether it's actually something important and noteworthy like Anthropic's propaganda department would have folks believe.

trademark 10h ago

@dalias @lispi314 @GossiTheDog @azonenberg That's not debunking. Actual debunking would be to provide evidence that what Anthropic achieved was not actually technically difficult. Instead of doing that you chose to insult FreeBSD. Instead of providing technical arguments you displayed your ignorance of the last 20 years of progress in NFS. Fascinating how somebody can be so wrong and still sound so arrogant.

trademark 10h ago

@dalias @lispi314 @GossiTheDog @azonenberg Oh, and also, earlier you said: 'I'm not going to address any claims about whether the "technical capabilities of their new model" are a thing.' But this is exactly what you need to do if you want to debunk what Anthropic is saying.

Cassandrich 10h ago

@trademark @lispi314 @GossiTheDog @azonenberg I am debunking the fraudulent importance from misrepresenting what software the vuln was in.

Whether their technical claims are bullshit is another completely legitimate area for debunking but not the one I'm engaged with in this thread.

trademark 10h ago

@dalias @lispi314 @GossiTheDog @azonenberg No, it is not fraud when you call something in the FreeBSD base system for FreeBSD code. If the code had been third-party code in ports you'd have had point. But that is not the case, so you are wrong again.

Cassandrich 10h ago

@trademark @lispi314 @GossiTheDog @azonenberg Running a NFS server in kernelspace is no less backwards than running a httpd in kernelspace (something Linux folks actually tried at one point; it was eventually removed).

Yes there will always be apologists for it. I am not worried about being considered rude when I state that this is just completely untenable from both a security standpoint and a good software engineering standpoint.

trademark 10h ago

@dalias @lispi314 @GossiTheDog @azonenberg Please tell this to the FreeBSD people, I am sure they will appreciate your insights.

@dalias @trademark @GossiTheDog @azonenberg > a good software engineering standpoint.

At first I didn't question it, as a naive computer user.

Then I experienced my first NFS server bug that broke a bunch of other stuff in the kernel and couldn't be fixed without a reboot.

I took the logical conclusion from that. Run as little as possible in the kernel.

When I learned about security after that and learned about the concept of ambient authority and isolation, I only became more convinced that conclusion was correct.

trademark 9h ago

@lispi314 @GossiTheDog @dalias @azonenberg The point of what Anthropic did was to demonstrate how good the new model is. Whether the NFS code should be in the kernel or not is an interesting discussion. However the fact is that exploiting kernel-level code usually is harder than attacking userspace programs. So when the AI succeeded in doing just that it is an indication of how technically skilled it is compared to earlier versions.

Cassandrich 9h ago

@trademark @lispi314 @GossiTheDog @azonenberg OK, blocking the AI booster shill concern troll who thinks he's stealth now. Can't believe I wasted this much time on this asshat already.

@dalias @GossiTheDog @azonenberg I consider the matter more of an instructive reading experience for onlookers.

@trademark @GossiTheDog @dalias @azonenberg Or evidence of awful security practices that should have been long discontinued but may (reasonably) subsist in code based on edge-case deployments (outside of which deployments it goes back to being unreasonable and an awful security practice).

That's an indictment of a project's quality, not a validation of the LLM's quality. Any vaguely qualified human without a personal stake in the project's current lacking state could've found similar indictment of the project's quality.

I have considerable concerns about how much of the filesystem support in Linux (and various BSDs) is in-kernel only, and Plan9 & Hurd (among others) actually do the right thing. There is absolutely no legitimate reason why the filesystem has to run in the same privilege level as hardware management & the rest of the kernel.

(Zero-copy schemes for speed are very much possible without making the filesystem server/translator a kernel program.)

trademark 9h ago

@lispi314 @GossiTheDog @dalias @azonenberg "That's an indictment of a project's quality, not a validation of the LLM's quality." So you're saying that FreeBSD is bad. Fine. Anyway an additional motivation for what Anthropic did is to help open source projects by alerting them to security vulnerabilities so they can fix them. Are you objecting to that as well?

@trademark @GossiTheDog @dalias @azonenberg

So you're saying that FreeBSD is bad.

In that particular capacity? Yes. Especially since no appropriate warnings are present.

Despite security model and architecture choice being monolithic, the FreeBSD project as a whole cannot be so easily considered.

Are you objecting to that as well?

Considering it cost millions (in unreported result) before that 20k$ finally got a result anyone they could pay 100$ an hour could've given them faster (that "it's a bad idea, lol, rip that out immediately")?

Yes. On an economic level it's extremely silly.

But on an ethical level it is also unconscionable. The exploitation & harms of the LLM/"AI" industry are not justified by spending more money for worse or comparable work a human could produce with orders of magnitude less resources & without such accompanying harms.

trademark 8h ago

@lispi314 @GossiTheDog @dalias @azonenberg Do you have a source for the millions in unreported results? For instance the phrasing in for ffmpeg is clear that it is ten thousand for all runs: "Mythos Preview identified several other important vulnerabilities in FFmpeg after several hundred runs over the repository, at a cost of roughly ten thousand dollars."

@trademark @GossiTheDog @dalias @azonenberg

Do you have a source for the millions in unreported results?

I had started an actual reply to this point but I realized I honestly don't care to actually source & argue it even if indeed monetarily their "20k$" only exists by externalizing basically all the costs.

Even if it was zero-cost or magically profitable to use it, the fact it's unethical trumps literally all of that. And that is what really needs consideration.

For instance the phrasing in for ffmpeg is clear that it is ten thousand for all runs: "Mythos Preview identified several other important vulnerabilities in FFmpeg after several hundred runs over the repository, at a cost of roughly ten thousand dollars."

That's a ridiculous amount of runs.

As for finding issues in ffmpeg, it's not very surprisingly. The project is infamous for this, to the point where many programs purposely run it exclusively in environments where all capabilities have been dropped.

Many, like myself, have been bemoaning its choice of tooling (and language) and practices for years (language has an excuse in acceleration API access being made for it, but the other two don't).

trademark 7h ago

@lispi314 @GossiTheDog @dalias @azonenberg I'm interested in what effects this model will have on the security landscape. Whether it is ethical or not, it exists and can't be wished away. Similarly while I also would like all software in general and ffmpeg in particular to be written in a decent language, this is not the case as the world exists today..

@trademark @GossiTheDog @dalias @azonenberg > Whether it is ethical or not, it exists and can't be wished away.

Slavery once did in a way that was vaguely accepted.

Clearly it no longer does anymore.

Wishing is not enough, but it's certainly possible to get rid of it.

> Similarly while I also would like all software in general and ffmpeg in particular to be written in a decent language, this is not the case as the world exists today..

That's also fixable.

Ensloppifying does not increase the set of trustworthy software to be found.

trademark 7h ago

@lispi314 @GossiTheDog @dalias @azonenberg

"Ensloppifying does not increase the set of trustworthy software to be found"

This is precisely what happened with this model though. It has found bugs written decades ago by humans, leading to these bugs being fixed. Leading to at least these programs being better.

@trademark @GossiTheDog @dalias @azonenberg In exchange for progressively destroying learning social infrastructure and increasing reliance on corposcum tools that actively deskill their users, thereby compromising long-term autonomy.

Power relationships are *also* a factor in trust. It wouldn't *matter* if Microsoft's software was literally perfect on a technical level, the blatantly abusable position they hold next to the user is enough on its own to refuse to use it.

It's a very minor benefit in exchange for much more systematic damage.

kravietz 🦇10h ago

@dalias

Unikernel is a way of achieving the same goal in a way that is reasonable from security point of view.

@dalias @trademark @azonenberg @GossiTheDog NFS-Ganesha is the userspace server the industry came up with specifically to not run an NFS server in kernelspace anymore.

It still sucks but at least it doesn't compromise the kernel and can actually be run with limited permissions.