Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.
Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn’t want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.
Edit: And for people that don’t know, this decades old linux exploit wasn’t just a single bug it found. It was able to piece together multiple smaller exploits that it found, that led to being able to exploit this bigger bug.
Ehh, that’s debatable. An LLM will gladly spit out a vulnerability report, but as LLMs lack any understanding or reasoning capability, there’s literally nothing guaranteeing that it has any semblance in fact or reality. They are just random text generators after all.
Going by Anthropic’s own numbers for things like Mythos, it “found” 29,439 vulnerabilities, when a human actually checked if the reports made any sense (ignoring validity) that dropped to around 6,200 reports, when they were tested for validity that further dropped to around 1,300 reports, and when it came time to actually patch the issues only 516 made the cut (i.e. the rest might have been issues, but weren’t considered exploitable, etc.).
516 out of 29,439 is a 1.75% success rate, not exactly groundbreaking.
Now to be fair, according to Greg KH at a recent talk, Mythos is seemingly improving. Of 79 vulnerabilities it reported, a solid 4 were real. That’s a 5% success rate, though it performed much better when it simply reported other developers bug fixes, something it did 11 times.
And how many security vulnerabilities have you found? 516 is still a lot. One of those had been in the Linux kernal for decades.
Edit: and many of those real ones from the 6000 group anthropic says the maintainers just didn’t want to fix as it was outside their threat model. A vulnerability in the Linux kernal, is different than one on an alarm clock app or something less serious.
Edit: And for people that don’t know, this decades old linux exploit wasn’t just a single bug it found. It was able to piece together multiple smaller exploits that it found, that led to being able to exploit this bigger bug.