Caging the beast
- Gary Hinson
- 4 days ago
- 3 min read
The past few days has seen a flurry of breathless articles in the cybersecurity press and blogosphere about Mythos, an exciting new AI model that can find and exploit software vulnerabilities, rapidly, efficiently, effectively, at scale.
For the white-hats, it's a way to find and fix those vulnerabilities before they are exploited.
For the black-hats, it's a way to find and exploit those vulnerabilities before they are fixed.
Patently, this is 'dual-use technology' a.k.a. a double-edged sword - more of a Swiss army knife in fact, with a spectrum of hats clamouring for the chance to check it out - more than 50 shades, I'm sure, and not entirely monochromatic.
Meanwhile, today's AI systems are known to hallucinate and lie convincingly. Is there really any point entreating Mythos to, "First, do no harm"?
Anthropic has already acknowledged the challenge of keeping Mythos - a powerful cage-busting cyborg - in its cage. Its public response has been to restrict Mythos access to about 50 organisations in "an urgent attempt to put these capabilities to work for defensive purposes."
That's ~50 powerful first-world/Western organisations and institutions, evidently. 50- shades of grey. Hold that thought.
Project Glasswing is a starting point. No one organization can solve these cybersecurity problems alone: frontier AI developers, other software companies, security researchers, open-source maintainers, and governments across the world all have essential roles to play. The work of defending the world’s cyber infrastructure might take years; frontier AI capabilities are likely to advance substantially over just the next few months. For cyber defenders to come out ahead, we need to act now.
Source: Anthropic
Mythos is doubtless not the only one of its kind. Shoving it unceremoniously back into the box it came in wouldn't uninvent it. Having forged and sharpened the sword, the world now faces a significant new challenge to ensure that it - and its progeny - is wielded for the benefit of society at large, rather than for the benefit of the few and the expense of the rest.
Speaking as an information security specialist, I am both intrigued and terrified. Like nuclear fission, the tremendous power means tremendous potential and tremendous concern. Risk and opportunity, flip sides.
Striking the right balance requires a complex blend of risk management, security, control, governance, compliance, integrity, value, transparency, trust and ethics - and, frankly, especially on that last point, we humans have a lousy track record. We have systematically engineered huge inequalities around the world, a gaping chasm between the privileged elite and the vast majority, clinging desperately to the edge for survival. While the developed world and its AI models burn fossils, our small Pacific neighbours submerge beneath the waves. We have nuclear power and nuclear weapons. Glorious leaders and narcissistic despots. Responsible disclosure and shameless exploitation. Offensive and defensive cybersecurity. So many sharp contrasts. So many finely-honed edges.
So, sooner than I thought and before the advent of Artificial General Intelligence, we're having to face-up to the impending battle, desperately gripping as our AI systems strain at the leash. The race is on between "building a stronger cage" and "building a more powerful cage-buster". On the upside, at least for now, it's 'us' doing the building, so there's a chance our AI kill switch might actually work.
Meanwhile, as always, I'm watching out for new terms, crafting plain-English definitions and slotting them in to the existing lexicon. Never a dull moment.
PS "Glasswing" is an intriguing choice of name. Is glass meant to suggest transparency or fragility? Wing as in soaring albatross or Icarus on a solar near-miss? Or both? The output of a crude password generator, perhaps, or the brainwave of a highly-paid marketing exec? Is "Mythos" mythical vapourware or real-world beast?
Comments