.jpg)
Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- I found that Claude / Sol were basically useless when approaching various CTFs that allowed AI tools, but running Qwen and DeepSeek locally and GLM via OpenRouter worked fine. It's blatantly obvious to anyone that even does tangentially cybersecurity related work that Anthropic's position here is stupid and detrimental to security.by tristor
- The Claude Security program looks similar to OpenAI Cyber Trusted Access.
The approval process seems quite intimidating, has anyone managed to implement these compliance standards?
by TZubiri - What are the SOTA harnesses for scanning a repo for vulnerabilities?by antiloper
- may have been rushed by hugging face being unable to use claude to debug or fix their breach, because there isnt detail on new guardrails put into place to protect against anthropic's initial concerns of wide distribution?
separately, it is interesting they are adding an oem type offer:
>We’re working with our cybersecurity technology and services partners to integrate Claude Mythos 5 into the products and services defenders already use to secure their software.
anyone know the shape of those contracts, e.g. pure tokens/usage or more of a traditional licensing or oem type structure?
by gz5 - Hugging Face was able to sign up for Glasswing but they just didn't.by wmf
- > Bringing the cybersecurity capabilities of Claude Mythos 5 to more defenders
This dance is quite annoying. When Anthropic releases a paid model, the user should control what it does and doesn't do. The other day I had a security incident that required urgent response. ChatGPT and Claude were utterly useless (I quickly attempted to get access to the former's advanced security capabilities but was met with a form I could complete - far too slow for a time-sensitive problem like a security incident!). So I used grok and it helped! I am told Kimi also helps in such cases although haven't tried it yet.
by nomilk - On the other hand, people are using Grok to do things like “nudify” images of random people they find online, including minors.
I’m not a fan of limiting access to models, but the other extreme (no limits or guardrails) is at least as bad if not worse.
- Voting matters. Remember these companies are trying not to get shut down overnight.by conception
- Screw you Anthropic and screw your gatekeeping, Opus 5 refuses even basic reverse engineering / patching tasks, even BPF is apparently too dangerous, you lost your minds..by zb3
- For those who had access, how does it compare IRL with GLM 5.3 ? iirc both models are similar in terms of benchmarks ?by gorgmah
- The GLM series is GOATed.
- I’ve been working on a decompilation project that fable was choking on and GLM 5.3 has been chunking away at it for 72 hours now? I think it’s my favorite agentic/implementer model right now.by conception
- From a cost perspective Mythos is too expensive right now. With the right Harness and a few layers of models you can get close or better in some circumstances. Kimi / GLM, Qwen etc. And that's before ablation / Abliteration...
For those in Mythos.. if you ask how much it cost to assess their repos, your jaw would drop. We're talking the price of buying a couple machines to run Kimi / GLM full weight outright.. for one Scan.
Right now I wouldn't say GLM 5.3 is the same, but it's not far off. For the cost benefit it's the better of the two.
- $35M in credits (!) for the Defender Advantage Fund (0xDAF) doesn't sound that much given that e.g. the HAWK attack [1] cost $100k for 1 (albeit very advanced) vulnerability.
As a side note, that Golden Eagle wording "bringing a wartime footing to the cyber domain to relentlessly patch vulnerabilities" sounds so AI-written maybe that's what the credits are needed for.
(1) https://www.anthropic.com/research/discovering-cryptographic...
by janpeuker - The HAWK attack was on a 3rd round PQC candidate that had been under adversarial review by experts for 3 years. It is an outlier and most vulnerabilities are easier to find.by sweis
- Seems like a whole lot of nothing for the average user. They have really lost the plot.by FL410
- I dont understand. Not everything has to be for everyone.by nonethewiser
- What a bunch of wankery from Anthropic. I already use Sol 5.6 for security auditing and it works great, and as a bonus doesn't give verbal vomit every time.by zeafoamrun
- I suspect this will be seen as a mistep by Anthropic in the long run. Including how their own hyperbole led to the US gov adding export controls.by dmix
- This week I found two issues in my company codebase. After finding them I told a claude session about one and asked for a quick proof of concept demo of the exploit. It refused, including refusing simple things in the same session afterwards.
Meanwhile same model in a new tab, say I need help creating a page that hits an endpoint with a special payload and it does the same things that were too dangerous in the previous tab...
by vasco - Just use an EU- or US-hosted Asian Opensource model. They will spit out everything.by BlackRabbit1
- I had that when opus 4.8 was first out. It repeated refused to make a PoC for an issue it suspected.
I eventually gave up and just asked it to fix the issue. The first thing it did? Write a PoC to verify the issue was still valid...
by eterm - The problem is that "cybersecurity" isn't some special task that only your security team does.
In the project I maintain, I find bugs and fix bugs. Some of those bugs might result in an LPE. I generate a regression test, then I fix the bug.
The problem is that generating a regression test for that type of bug is technically a PoC. I can almost never get Fable to create one. Sometimes Opus 5 punts as well. Same with Sol and Luna.
That is, unless I socially engineer the model. I can't talk about security. I make sure they don't read the file call cve_test.c (literal regression tests for CVEs). I have to hide part of my project from the models for them to work.
Anthropic and OpenAI are driving me to use other models.
by jnwatson - Sometimes you can't get Fable to create one? Most of the time I can't even get Fable to investigate why a unit test is crashing because a segfault is a cyber security risk so it changes the model automatically. Drives me hp the wall how hard they clutch their pearls here, Codex has given me no such trouble.by zamadatix
- Agree 100%. This is just another level of obscurity. Security through obscurity... Its annoying, very annoying.by sscaryterry
- Every one of their models has become absolutely useless, for validation of bugs and the remediations. Unless I’m doing straight forward dev work, I’ve turned to alternate models and harnesses I’ve started building on my own. The frontier models have apparently become so good at security that they can’t be bothered to discuss it with laymen…by igetspam
- I’m a web performance engineer — I help clients find and fix site speed issues — but recently I spotted what I thought might be a security/privacy issue. Security not being my specialism, I asked Fable to help me triage and, if necessary, raise the issue with my client.
It refused. It’s so so so adjacent to the work we’d already been doing, but the moment I asked it to help me understand what I thought I’d found, it left me high and dry!
by csswizardry