Mythos AI is a cybersecurity threat, but it doesn’t rewrite the rules of the game
Laurent H. — CEO & Founder CYBERR & HEELR
Mythos AI is a cybersecurity threat, but it doesn’t rewrite the rules of the game
During a controlled evaluation, engineers with minimal security experience prompted Mythos to scan thousands of software codebases for vulnerabilities. The model showed striking capabilities in conducting multistep, autonomous attacks that take experts weeks or even months to put together. Mythos was not only able to discover 271 vulnerabilities in Mozilla’s Firefox, it also developed exploits to take advantage of 181 of those.
Overall, Anthropic’s red team, which takes on the role of an attacker to test defenses, and the United Kingdom’s AI Security Institute reported that Mythos found thousands of zero-day, or previously unreported, vulnerabilities in major operating systems, web browsers and other applications – software flaws that have not yet been patched and can be turned into exploits immediately. National Security Agency officials testing Mythos have been impressed by the tool’s speed and efficiency in finding software vulnerabilities, according to a news report.
Among the most widely reported were Mythos’ ability to identify a dormant 27-year-old security flaw in OpenBSD, a security-focused operating system, and a 16-year-old bug in FFmpeg, a video/audio processing tool. Some of these flaws allow unauthenticated users to gain control of the machines hosting these applications.
Even more striking, the relatively inexperienced engineers running Mythos’ evaluations were able to use Mythos to complete attacks overnight, from finding vulnerabilities to exploiting them – something that can take human experts weeks to do. The model’s ability to chain multiple steps is what surprised Anthropic and organizations that tried it. In an evaluation by the AI Security Institute, Mythos was able to take over a simulated corporate network in three out of 10 tries, the first AI model to succeed at the task.
These results are real. They also paint an incomplete picture in ways that matter.
https://theconversation.com/mythos-ai-is-a-cybersecurity-threat-but-it-doesnt-rewrite-the-rules-of-the-game-281268
1 reactions · 0 comments