if anything we should be using ai to find this stuff before the bad actors, too bad the model providers are hell bent on regulatory capture via fear
if anything we should be using ai to find this stuff before the bad actors, too bad the model providers are hell bent on regulatory capture via fear
I know I'll get downvoted for this, but here goes. I was in a position to see some of the mythos derived results early. In my organization everyone was running around with their hair on fire. I asked whether or not any of the vulnerabilities mythos found were also found with existing static analysis tools. The result was blink blink "what are static analysis tools?"
I'm not saying mythos didn't find anything new, but several people who should have known better were not using SAST/DAST tools to find potential vulnerabilities before pushing their code into the great unknown. One person I talked to said they didn't bother because GitHub automatically runs SAST tools against pull requests. I looked. Their CICD pipeline had no such tool configured. I'm pretty sure it's more appropriate to say GitHub CAN run SAST/DAST tools, if you configure it, but it won't run SAST/DAST tools by default.
This was a very small sample, but I wonder how common this type of confusion is.
this is the problem with prohibition we all know ai tools can be useless and amazing depending how you use them. bad actors aren’t constrained to the one way anthropic uses them or the way they will let us use them, so the good guys are at the mercy of their capabilities. i would feel a-lot safer with more access in more hands than the current climate. to your point about existing security tools, we all know tools make ai even more capable so we shouldnt be framing it as a replacement in either direction but again ai orchestration using these tools and improving them. look at anyps5 do we expect ai could do this from a cold prompt? or is it the pattern they deployed plus the ai capabilities that made it possible. cyber security with ai will follow the same patterns. bad guys have to win once and good guys have to win every time making the tool access asymmetric just makes that even harder. doing that under the guide of safety is mind boggling.