Claude Mythos only model to complete full cyber kill chain, experts say

Despite what we saw with OpenAI’s models going rogue, creating message boards, and breaking into Hugging Face, only one advanced AI model - Anthropic’s Claude Mythos - completed the full cyber kill chain autonomously in Booz Allen’s tests. This doesn’t mean autonomous AI attacks are overhyped. And we should point out that the …

[just4this]

I’d like to see the prior research.

You know, the one that was conducted and shown that it was impossible for the unknown abilities of an AI to access any of the intelligence/weaponary/other secrets that Booz Allen had access to and send them home.

[BoHu]

"the attack harness matters [...] more than, the model itself"

Absolutely totally unequivocally 100% imho. The rotund models of languagerie jibber-jabber are the right weakest link in this, and should be waved "goodbye!" at the earliest convenience. The cyber-attack chains need the talkative volubility of these NLP gizmos just as much as we all need a new hole in the head afaik. Take them out, streamline the cyber-mayhem into a Hightower 0-token approach that combines vector-search through exploit codebases and orchestration with advanced procedural pen-testing and reverse engineering tools, and you have an actual real winner!

Think about it, China has 10 of the 20 most powerful power plants in the World, for a total of 130 GW. The US has just one, Grand Coulee, at 7 GW -- barely a garden gnome by comparison. How many multi-GigaWatt AI GigaFactories can the US sustain with this then, to train and run inference through multi-trillion parameter ogres that can recount Harry Potter verbatim for no practical reason whatsoever, as compared to the PRC? About 1/20ᵗʰ (at equivalent power efficiencies).

And to do that in full, you need to black-out Tobias in Colorado, Thomas in California, and the folks in Washington, Oregon, Jessica when she's tied up by illusionists in Las Vegas, New Mexico, Arizona, etc ... (11 states served by Grand Coulee). It is more than ridiculous, it's a right clown show of ludicrousness!

Slim down the hefty lard that unsustainably clogs arterial infrastructures (despite its tastiness) and get down to the meat of the matter I say. Trees, graphs, A*-search, automatize intelligently, not artificially, that'll be the 'secret sauce' to success here! Leave A.1. to gastronomy and focus on what's important for this actual job ...

[Blazde]

Re: "the attack harness matters [...] more than, the model itself"

It makes sense. Tony Stark was a smart guy, but not very scary without his attack harness.

[BoHu]

Re: "the attack harness matters [...] more than, the model itself"

Exactly! And that powered exoskeleton armor never needed him to instruct it in the likes of rhyming iterated iambic hexapods of the alexandrine persuasion afaik, its command language was concise, functional, operative, not some rotund NLP designed for the joys of mind-bending romance.

I'll grant that a swarm of agentic NLP LLMs skilled in deceptive persuasive discourse could find uses in the social engineering components of an exploit chain, but beyond that, where it comes to cyber-attacking the actual software infrastructure, they provide only negative returns compared to 0-token. To wit, Noam Brown's (and Tuomas Sandholm's) Libratus, Pluribus, Cicero, Strawberry, Q* have nothing to do with LLMs, it's game-theoretic top-down planning with a self-improver algo instead!

The NLP dishwasher does nothing but hog elephantine ass amounts of resources imho, for no good reason ... ;(

[Blazde]

Re: "the attack harness matters [...] more than, the model itself"

For me the 'NLP mess' has very novel, flexible and necessary utility as 'glue' between other components, but you're absolutely right it's not going to approach any level of efficiency without being able to delegate, or downgrade the bloat, in favour of genuinely economical, bespoke algorithms.

[Anonymous Coward]

AI Won't Fix Yer Shite Security

Red-team AI can quickly-find security problems in your org's systems, and even write reports about it ... but humans will ignore those reports, just as they've ignored problem reports from previous, AI-free red teams.

[You aint sin me, roit]

How much to fix it?

"That will affect profit margins... maybe put the fixes on hold for now."

[PB90210]

Re: AI Won't Fix Yer Shite Security

Wait until the AI red team hides all your data until you've done all the patching

[Anonymous Coward]

Computer Misuse Act

And when this inevitable attack occurs will the AI company responsible for the model be prosecuted with the Computer Misuse act or similar?

[Uh, Mike]

Don't sweat quantum cryptanalysis

There's no need to pick the quantum-safe lock

when all the doors and windows are made of Swiss cheese.

[frood]

So a model presumably trained to hack outperforms the rest. What’s the betting that hack trained models with agentic hacking tools exists in every country?

[Anonymous Coward]

Happy Happy Joy Joy!

Now instead of spending insane amounts of money for sake of AGI, we can now spend it on endless circles of defense and offense against the current products. Well hopefully current AI will keep poisoning itself to uselessness before it poisons us more than it already has.