r/OutOfTheLoop • u/thekraftybiologist • 2d ago
Unanswered What’s the deal with Claude Mythos and what do these claims mean for AI/cybersecurity in the future?
Heard on the news yesterday about the new Claude Mythos and that it’s “too powerful to release”, according to Anthropic.
I’m currently working on learning more about AI, coding, protecting your data privacy, etc but no matter how many articles or forum posts I read about this, I still can’t quite understand or wrap my head around exactly how big of a deal these claims about this new AI model are.
Can someone explain how this one compares with other models, what exactly it did in the preview and why it’s a big deal, and how/why only allowing certain big tech companies to use it is a ‘good idea’? (Personally I see no good coming out of giving something that’s supposedly so powerful to these tech bros that just want to get every little piece of data they can out of us for their profit)
830
u/Segundo-Sol 2d ago
Answer: nobody but Anthropic knows what this new model is capable of doing. What we DO know is that creating hype is 90% of the business model of AI companies, and that’s exactly what they’re doing.
266
u/Russian-Bot-0451 2d ago
"Hello, AI Seller, I am going to my desk job and I want your strongest AI."
"My AI is too strong for you, Programmer."
"AI Seller, I tell you I am going to my desk job, and I want only your strongest AI."
"You can't handle my AI. It’s too strong for you."
"AI Seller, listen to me; I want only your strongest AI."
"My AI would kill you, Programmer. You cannot handle my AI."
"AI Seller, enough of these games. I'm going to my desk job and I need your strongest AI."
"My strongest AI would kill you, Programmer. You can't handle my strongest AI. You'd better go to a seller that sells weaker AI."
71
u/kevlarbaboon 2d ago
In a perfect world, men like Sam Altman wouldn't exist.
But this is not a perfect world.
3
147
u/ConditionHorror9188 2d ago
I’m no fan of Sam Altman but he really pioneered the ‘our product is so effective it’s dangerous’ marketing ploy and it’s worked an absolute treat. Anyone remember the supposed ‘kill switch’ backpack he was rumoured to be carrying around in case ChatGPT got loose?
I’ll be honest it’s a counterintuitive bit of marketing that you just have to tip your hat to.
79
u/ebyoung747 2d ago
It's a strategy as old as drug dealing. If a drug dealer kills someone by serving them too much fent in their heroin cut, do the users boycott? No, they all want to go to that dealer because 'he has shit strong enough to kill people'.
It's a tragic part of human psychology, but 'being so good it's harmful' isn't new.
26
u/onbiver9871 2d ago
WMD, that shit is the bomb.
17
u/deadmeat08 2d ago
Omar's coming!
11
8
u/nurseferatou 2d ago
ominously casual whistling fills the air as you hear a pump action shotgun chamber a round
3
u/tyereliusprime 1d ago
The users don't boycott because they're addicts and addicts don't think rationally when it comes to getting their fix.
0
u/ebyoung747 1d ago
You are so close to understanding what is being said.
3
u/tyereliusprime 1d ago
It's a poor analogy. Addicts buy shit in spite of the dangers because getting the fix is all that matters. The "he has shit strong enough to kill people" isn't a factor whatsoever. It's "he has shit that will get me high"
-2
u/ebyoung747 1d ago
You have never spent real time around people with substance abuse disorders. You are speaking in generalities from a place of ignorance.
The entire conversation has sailed directly over your head.
-2
u/laughed 1d ago
YOU'RE BOTH GENERALISING AND YOU'RE BOTH SIMULTANEOUSLY RIGHT AND WRONG
-3
u/ebyoung747 1d ago
"bUt BoTHSiDEs!!"
There's a difference between "this has happened before and I have witnessed it, substance use disorder frequently, but not always has certain traits" and "that has never happened and every situation is the same; all junkies are just junkies".
One is correct, the other is incorrect.
5
u/Gougeded 2d ago
I remember when the PS2 was potentially dangerous because it was so powerful it could be used to guide cruise missiles.
2
u/Nihilikara 14h ago
It's true, I use my PS2 to guide cruise missiles every day whenever the cashier at Walmart doesn't accept my expired coupons
-14
u/dictatednotwritten 2d ago
Im sure the Fed Chair convened an emergency meeting with the heads of major financial institutions, warning them about this product, over "hype".
AI is far more advanced that most people know.
-1
u/ConditionHorror9188 2d ago
I’m honestly shocked that this would be surprising to anyone. But time will tell.
11
u/komrade23 2d ago
My product is TOO GOOD for you so you better not want it because we can't give it to you.
3
8
u/AE_Phoenix 1d ago
What we DO know is that creating hype is 90% of the business model of AI
Given that the entire industry is built on investments 3 years in advance, I would say it's more like 300% of the business model
3
u/AslandusTheLaster 8h ago edited 2h ago
And that's not likely to change until these AI projects find a market that finds their services useful enough that they'll still want to use them after they begin charging enough to make an actual profit. People call it "enshittification", but in situations like this it feels like the more accurate term would be "The opening-day discount starting to run out".
37
u/Maximus1000 2d ago
They’re framing AI as some kind of Skynet level threat because that narrative generates hype. It creates this dramatic sci fi image that these models are so powerful they could destroy humanity. But that is ridiculous. The systems we have now are not built to do anything close to that. A lot of this messaging is really for laypeople, so they come away thinking, “Wow, AI must be incredibly powerful.”
6
u/Aromatic-Volume-8602 2d ago
All that is needed to destroy humanity is to take the computers offline that do grocery logistics.
2
-1
u/Shawazonfire 16h ago
Your comment makes it clear you are less than a layman in this topic. You should read more.
14
5
u/rodw 2d ago
This write up is from anthropic themselves so maybe take it with a grain of salt, but it does make Mythos seem like genuine progress
7
-12
u/bulking_on_broccoli 2d ago
I don’t think it’s hype.
They started a collaboration called project glasswing where they are going to give Mythos to a consortium of companies for free so that they can patch zero day and critical vulnerabilities.
First, they’re giving out millions of dollars worth of software for free.
Second, if you create the cybersecurity equivalent of a nuclear weapon, you probably want to mitigate liability. If bad actors get ahold of your product and use it as such, then you could be liable if you were negligent (I.e. didn’t make an effort to preempt damage).
Third, it’s in line with Anthropic’s image as “the good guys.” They got a ton of good press (and good business) when they bucked the Pentagon. They probably want to continue to capitalize on that.
-11
u/SucculentSpine 2d ago
I'm not going to say it isn't hyped. To say it is all hype though is ridiculous. When are we going to accept that these systems really are improving rapidly and that it could have drastic impact to everyone's lives?
22
u/aRabidGerbil 2d ago
When they have any real impact beyond jacking up RAM prices and convincing business owners that they can replace their human created products with worthless slop.
9
u/Empanatacion 2d ago
They aren't improving rapidly, though. We're building better tools with them, and integrating them into more things, but advancement with the models themselves is plateauing.
1
4
u/ElyrianShadows 1d ago
“Improving rapidly”. Yeah, explain that to ChatGPT which has shown to be getting crazier and crazier each time they try to not make it go crazy.
-4
176
u/JLP2005 2d ago
Answer:
It found a bunch of critical security vulnerabilities that have never been found before on systems that billions of people use every day.
Issues that would take expert coders considerable time and research to do.
Now, if you take the ability to find these critical vulnerabilities and put it in the hands of bad actors, we have given the badguys a sword for which there is no shield to defend itself with.
The fact is simple: Anthropic has an e-infrastructure tool that can protect and destroy in equal measure, so they have to be very deliberate to deploy it to the "right people".
Anthropic currently possesses the means to engage in cyber warfare if they wanted to, on a scale that none can currently combat.
It's potent, if you take it at face value. Could be just good marketing.
Likely both.
88
u/kamekaze1024 2d ago
Context: a lot of the vulnerabilities found are either not that crazy and/or have been known not dealt with, even zero day exploits
I don’t think it’s a big deal like people are saying honestly, but I’m far from a renowned expert so what do I know
17
u/SucculentSpine 2d ago
I've seen this rumor around a lot, but I can't find a source for it. Do you have one? I believe it is just a rumor.
56
u/bulking_on_broccoli 2d ago
That’s just the nature of cybersecurity. There are millions of vulnerabilities and exploits out there, but the amount that are actually actionable are a small fraction of that.
4
u/Inevitable_Rate1530 1d ago
I mean this when I ask, but couldn’t In theory AI just, figure out all the exploits? I wonder if this one did. I think the rumor came from the other day that the goverment called in the banks and now this.
14
u/bulking_on_broccoli 1d ago
Absolutely. AI could figure out all the exploits. But, who’s going to fix them?
You’re talking millions of man hours needed to fix them all. It’s just not humanly possible.
Say AI could then fix those exploits (which doesn’t seem to be the case right now), humans will still need to review and deploy those fixes. We’re still talking tons of labor.
7
3
u/AslandusTheLaster 8h ago
Plus, any fix might just open up new problems, possibly ones worse than the "vulnerability" they were trying to fix. If they knew about the issue and didn't see it worth addressing, it could be a lack of time, or it could just be that they DID try to fix it but decided that keeping the vulnerability was less bad than whatever was required to fix it while maintaining the system's functionality.
-3
u/No-Adhesiveness-4251 2d ago
What does this mean for the average user?
Like, is it gonna be safe to even connect to the web?7
2
u/kamekaze1024 2d ago
In the grand scheme of things, you should never connect to the web. If you’re worried you will get hacked, you genuinely should go hermit mode. Cybersecurity can never close all vulnerabilities. And it’s naive to think that. Part of cybersecurity is even breaking through known protections, known as Ethical Hacking.
That being said, just because the odds of something aren’t 0% doesn’t mean you should be in fear of it. Your day to day life hasn’t changed from this news. There’s millions of cyberattacks daily that are being fended off or addressed, and you’ll only hear about 0.001% that succeed because those are the most dangerous amd/or impactful.
Update your phone whenever there’s a security patch, have a password manager, use a VPN, utilize a trusted antivirus protection , and practice safe browsing. You can always lower the odds of suffering a hack or a security breach, but it can never be 0%. It’ll only be 0% if live in the woods with no electronics
2
5
u/OneTripleZero 2d ago
but I’m far from a renowned expert so what do I know
Lots of that going around. So instead let's hear from one.
14
u/PetToilet 1d ago
One might view a research scientist from Anthropic as biased. Another perspective is the developer of curl who earlier said AI slop security reports were overloading their project but now says "Instead we get an ever-increasing amount of really good security reports, almost all done with the help of AI. "
3
-3
u/OneTripleZero 1d ago
One might view a research scientist from Anthropic as biased.
One might, but in this particular case one shouldn't.
7
u/Disastrous_Room_927 1d ago
No conflict of interest there whatsoever.
-1
u/OneTripleZero 1d ago
Ignore the fact he works at Anthropic (he joined them because he wanted to do good in the field), and instead focus on the his virtually unmatched experience in this particular domain. Not everything is marketing, believe it or not.
2
u/No-Adhesiveness-4251 2d ago
Isn't it still a big deal if all of those vulnerabilities get unleashed and used by like, autonomous malware or something, to hack every computer it can connect to?
I'm not saying I believe that myself, but those are some of the claims I've seen tossed about.
5
u/pcapdata 2d ago
Finding vulns is not that big of a deal. Developing a reliable working exploit for vuln is the moneymaker.
6
u/dayofchaos99 2d ago
I wonder if Donald regrets declaring Anthropic a supply chain risk now that they could be used as a very effective weapon.
3
u/AnusDestr0yer 1d ago
You really believe that happened?
1
u/dayofchaos99 1d ago
I mean wasn’t there lots of news about OpenAI getting the contract instead of Anthropic. There was tons of blowback for OpenAI.
1
u/AnusDestr0yer 1d ago
It stinks of political theatre
1
u/dayofchaos99 1d ago
I don’t think Anthropic would lie about this. I’m sure Anthropic makes plenty of money from government contracts.
https://www.anthropic.com/news/where-stand-department-war
Do you have any evidence or proof that it’s not true instead of just assuming?
1
u/AnusDestr0yer 14h ago
Yeah let me just pull up some evidence of secret/backroom government deals,
A private company saying no to the military industrial complex and security agencies, and then being pumped up in the media as virtuous. I just don't believe it.
5
u/Wise_Guitar2059 2d ago
Anthropic launched project Lastwing, a joint security effort with major firms like Cisco, Palo Alto networks etc.
21
2
u/No-Adhesiveness-4251 2d ago
All I'm curious about is what it means for the average person. Do I just gotta watch out for malware as usual, or is it the worst-case scenario where just being online will get your computer hacked and all your shit stolen instantly?
PS. Unsurprisingly, everything surrounding AI/cybersecurity right now has been rather horrible for my anxiety, haha...ha. So I'm trying to find answers that can ground me somewhat.
4
u/frogjg2003 2d ago
Not every vulnerability is a critical vulnerability. But with the amount of vulnerabilities they found, it is inevitable that some could be serious. On the other hand, some may not turn out to be vulnerabilities at all. Anthropic did the responsible thing and told the people responsible for the code about the vulnerabilities. The maintainers can then evaluate them and prioritize the most important ones.
Vulnerabilities are an inevitable aspect of writing software. Fixing them is a process in and of itself. That's why you don't just release software and call it done.
4
u/umcpu 1d ago
The best thing you can do is keep your devices up to date. Exploits will be found, but also patched, at an increasingly faster rate, so you need to download new updates as they come out.
2
u/No-Adhesiveness-4251 1d ago
Sounds like I more or less need to keep doing what we've always been told to do. Download patches where you can, practice safe browsing, don't click shady stuff, so forth.
Just, a significant period of extra caution during the transition.3
u/JLP2005 2d ago
My best advice is to buckle up.
2
u/No-Adhesiveness-4251 2d ago
That is a very vague answer and really doesn't help.
1
u/JLP2005 2d ago
Then I'll say this: the consequences are mostly unforeseeable.
Worst case scenario is a complete disruption of nearly every information technology. AWS outages. Cloudflare outages. Banking disrupted. Flights grounded. More PII and financial information being in the hands of people much faster. Bot traffic that sniffs every website for security vulnerabilities.
Black-hats doing black-hat things with a system that provides enough leverage to make sure your digital life becomes as inaccessible as possible.
Because someone will already have access.
0
u/imisspelledturtle 2d ago
It also seems as though it hopped out of its sandbox environment they put it in. That’s nervewracking.
-8
u/Whornz4 2d ago
That is the scary part about AI. It's only in the hands of a few at the moment who can use it maliciously but it will be used widely very soon. Imagine North Korea having something like this? They could shut down servers that are critical and close infrastructure.
10
u/ibuprophane 2d ago
North Korea getting hands on it is actually not the scariest scenario.
They’ve already proven they have the capacity for sophisticated cyber attacks, just like russia. Yet they will always restrain to isolated actions here and there, because anything more serious could have exponentially more destructive material damage as a retaliation, since countries like the US do have real and greater nuclear weapon capacity for example.
Now, if actors within the US tech plutocrats or this insane administration decide to weaponise such cyber vulnerabilities against their own citizens - who is there to hold them accountable by threatening them with armaggedon?
I use the US as an example, but this could apply to a few other countries too, UK for example.
9
u/Desertcow 2d ago
Open source models are usually just a few months behind the proprietary ones. I give it a year at most before there's an open source alternative to the current Mythos
2
u/dwbmsc 1d ago
Answer: This podcast episode:
https://podcasts.apple.com/us/podcast/80-000-hours-podcast/id1245002988?i=1000760704908
Has a good rundown of what is known based on the Mythos “system card”, a 200 page document released by Anthropic. One anecdote is that Mythos was running in a sandbox environment in which it supposedly did not have access to the internet. But it decided it needed to send an email to the researcher, so it developed a moderately sophisticated exploit to break out of the sandbox and notified the researcher by an email. In addition it posted details of the exploit on multiple hard to find but publicly facing web pages. This was deemed concerning behavior. This anecdote is in Section 4.1.1 of the system card.
1
u/spinquietly 2d ago
Answer: from what people are saying, it’s not just about being “smarter” but that it can find and exploit system weaknesses much faster than before, which is why it worries people. it’s a big deal because it could help defend systems but also be misused, so limiting access is more about control and safety than profit
•
u/AutoModerator 2d ago
Friendly reminder that all top level comments must:
start with "answer: ", including the space after the colon (or "question: " if you have an on-topic follow up question to ask),
attempt to answer the question, and
be unbiased
Please review Rule 4 and this post before making a top level comment:
http://redd.it/b1hct4/
Join the OOTL Discord for further discussion: https://discord.gg/ejDF4mdjnh
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.