How are Leaders Preparing for the AI Vulnerability Storm?

After Anthropic's Claude Mythos revealed thousands of vulnerabilities in critical software, leaders are preparing for 'Mythos ready' security

TL;DR

Anthropic's Claude Mythos demonstrates AI's extraordinary bug hunting capabilities, revealing thousands of vulnerabilities in mainstream software.
The speed of AI-driven vulnerability discovery and exploitation outpaces traditional human defense mechanisms.
The security community is developing 'Mythos-ready' strategies, emphasizing the use of AI agents for proactive vulnerability detection and faster response.
Organizations must adopt AI tooling and double down on fundamental security controls, integrating AI agents at all levels.
Future security programs must prepare for ongoing AI technology disruptions, focusing on maintaining balance and operating at machine speed.
Technical architectures incorporating isolation, zero-trust, and deep segmentation are crucial for AI-era operations.
The focus is shifting from stopping attacks to operating through them by enhancing visibility, response, and containment at scale.

Continua a leggere l'articolo originale

I’m proud that so many of the world’s leading companies have joined us for Project Glasswing to confront the cyber threat posed by increasingly capable AI systems head-on.

https://t.co/pn3HSVsThP

Dario Amodei

Replying to @DarioAmodei

The dangers of getting this wrong are obvious, but if we get it right, there is a real opportunity to create a fundamentally more secure internet and world than we had before the advent of AI-powered cyber capabilities.

Dario Amodei

Replying to @DarioAmodei

Cyber is the first clear and present danger from frontier AI models, but it won’t be the last. If we are able to collectively rise to the challenge and confront this risk, it could serve as a blueprint for addressing the even more difficult challenges that lie ahead of us.

Yann LeCun reposted

Daniel Jeffries

Finally a semi-useful read on Mythos that is free of myth and talks about what this means more practically (not this is the end of the world as we know it, but how do we deal with faster patches and attacks from AI as other models scale to chained exploits)?

This is the kind of conversation we need, not idiotic ones about the end of all software.

We need "what is the right answer?" because these models are coming and will get better so how to we put our heads together and make better/more secure software across the world?

And it can't just be patching the 100 or so projects that got access to Project Glasswing.

That is not gonna help the world.

We need to figure out how does everyone else who is not part of the special chosen people to get blessed with access to test and patch their stuff, aka the open source projects and closed software that is not Office or Cloudflare but the 99.99% of software that runs everything else in the world?

What is the right loop cycle to help people patch and fix things at the source?

In the long run, AI will make software more secure, not less.

But it will change how teams have to work to get there.

Figuring that out means putting it in more team's hands sooner rather than later.

Sundar Pichai reposted

Thomas Kurian

Today we’re introducing Google AI Threat Defense - a comprehensive AI-powered cybersecurity solution designed to help continuously monitor for and stop AI-powered threats before they can impact your business. Here’s how it works:

1. AI Threat Defense uses our cybersecurity platform @wiz_io to scan and prioritize what applications and systems have the highest security risk.

2. Gemini and other frontier AI models can then autonomously perform continual deep scanning of your applications - starting with those at the highest risk - to identify security vulnerabilities.

3. The capabilities of CodeMender - a new software repair agent - are then used to verify and accelerate the patching of vulnerabilities.

4. And our @wiz_io autonomous agents continuously test your systems to find unknown vulnerabilities before adversaries do so that you can remediate them before you are attacked.

While other model providers focus on using AI to find and flag vulnerabilities, Google AI Threat Defense actively prioritizes your most critical real-world risks and accelerates their remediation using a variety of models since no single model finds a superset of the vulnerabilities found by all other models.

clem 🤗 reposted

Rohan Paul

The White House and Anthropic may have found the first serious path to restore Mythos and Fable access without pretending jailbreaks can be eliminated.

AI regulation may be shifting from vague fear to a benchmark based tests of model failure, because completely removing absolutely all jailbreak is probably not a possible target.

The proposed framework would score how far the bypass went, what capabilities became reachable, how repeatable the attack was, and whether the exposed behavior had real operational consequences.

Both sides are now moving toward a shared way to score what a jailbreak actually means.

The hard truth is that perfect immunity is probably the wrong target; a recent red-team study found even hardened frontier models still produced confirmed harmful completions under sustained automated attack, with Fable 5 remaining more robust than Opus 4.8 but not invulnerable.

So once, for a newly released model, the governments can ask the same questions every time, how much was bypassed, what capability was exposed, how reproducible was the attack, and what damage could follow, thats a much more practical path.

clem 🤗 reposted

Knighthawk

ok the Hugging Face breach writeup is one of the more honest post-mortems I've read in a while, and there's a detail buried in it that's way more interesting than "AI agent hacked us."

Their IR team tried to investigate the attack logs using normal frontier model APIs. Couldn't. The safety guardrails on the commercial models wouldn't let them submit the actual exploit payloads and C2 traffic for analysis, because from the model's point of view that just looks like... an attack. So the same guardrails that are supposed to protect you locked their own responders out of doing forensics on their own breach.

They ended up standing up an open-weight model (GLM 5.2) in-house just to get through 17,000+ log events fast enough to keep pace with the attacker.

That's the real lesson, and it has nothing to do with agents being scary. If your IR plan assumes you'll have clean access to a capable model mid-incident, go test that assumption today, not during the next 2am page. Vet something you can run yourself before you need it.

https://t.co/HwQxlsbLw1

clem 🤗 reposted

VentureBeat

AI-enabled attacks are up 89% year over year. Hugging Face's breach shows why IR plans need a fallback for when commercial AI APIs refuse to help mid-incident.

https://t.co/XsbFtlSmrg

clem 🤗 reposted

Adrien Carreira

Hardest IR of my career: one narrow objective, endless parallel paths, machine speed. One takeaway, we fought back with open models, in the open. AI security won’t be solved by one company in secret. Open source puts these tools in every defender’s hands https://t.co/6dngN4umDB

Arthur Mensch

Leaders are moving to open weight solutions to own their AI deployment and IP. We're here to help, thank you for the leads

https://t.co/eZiRvThJle

clem 🤗 reposted

Hugging Face

AI security improves when organizations share research, tools and real-world experience.

We’re joining industry leaders, including @NVIDIA, in the Open Secure AI Alliance to help organizations identify and address software vulnerabilities and strengthen critical systems.

Learn more: https://t.co/AC6coLN3EV

clem 🤗

The first autonomous agent cyberattack is an unprecedented event that deserves unprecedented transparency. Today we’re sharing everything we can: a full technical timeline, an interactive replay, and how we used an open model to defend ourselves, so defenders everywhere can learn from it and prepare for what’s next.

https://t.co/uPxIpjW8Xn