Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser.

Scary but also cool

Did someone actually go through all of those and check if they are high-severity or did the AI just tell them that?

They mention that they have humans review the most crticial bugs before sending it to the maintainers in their dev blog.

Every piece of software definitely has serious vulnerabilities, perfection is not achievable. Fortunately we have another approach to security: security through compartmentalization. See: https://qubes-os.org

Once you get the compartmentalization working well, and “all” of the vulnerabilities are out of it too, of course…

But even then you’ll have users putting things in the same compartment for convenience, rather than leaving them properly sequestered.

> and “all” of the vulnerabilities are out of it too

This is a good point; however the isolating code should be much smaller and easier to verify.

Or more likely, its just an exaggeration or lie.

What evidence makes you say that? Do you have insider info?

Neither party provided the evidence. I wonder why people like to take the side of the optimistic.

We already know Opus can find real vulnerabilities ([1], [2], ...), so it's not exactly surprising that a bigger model is better at it.

[1] https://news.ycombinator.com/item?id=47273854

[2] https://news.ycombinator.com/item?id=47611921

That is not thousands high-severity vulnerabilities as above commenter stated. Even many local models have found individual vulnerabilities.

What evidence do we have that it is true?

I don't need any. I'm not making the claim that it's "most likely a lie".

pssst. It is. They all have the same investors and customers to please.

how many TPS does a build like this achieve on gemma 4 26b?

The beauty of sharing things is the feedback you get from others, which then gives you validation that something you're interested in is something others are also interested in or derive value from.

When making a blog post, how else do you get this feedback? 99% of people click, read it, then move on. Quantifying how many people have read, how long they spent reading, and where they came from, is an essential part of interacting with the digital world. Without it you are flying blind.

> The beauty of sharing things is the feedback you get from others

I agree with this, less so with the validation part, but receiving feedback from others is lovely, pretty much always! But with that said, this isn't the goal or even intention for a lot of people who publish their written texts on the internet. Sometimes people just want to unload, share some tip, or any of the other countless of motivations people can have.

There is nothing that makes people who hit "Publish" and never look at the analytics do anything less "essential" than people obsessing over the metrics, they just have different motivations and reasons.

Personally, I don't feel the need of quantifying anything about most of the stuff I publish one way or another. For example, I don't really care about the HN upvotes/points. Sure, it's fun that some people are enjoying what I write, but I'm participating for the discussions themselves and to learn something new, both about myself and others. Upvotes don't really give me that, but thoughtful replies really do!

I think there's an easy litmus test for everyone who claims not to care at all how many people read what they wrote:

Would you be as happy just saving that file to your hard drive, instead of publishing it online?

I feel like that's missing that "putting it out there" or making some thoughts public is different than not doing so, regardless if you care about what happens afterwards or not.

then he'll really have come clean

who the fuck wants to do sarbanes oxley. sox killed IPOs. the private market is quite liquid. why attract activists and losers with an agenda to your company

You’re right that “trend” is the statistical term, but “hype train” is the idiom people actually use. I always try to write closer to common and simple vernacular when possible.

Got it.

maybe I'll do that next :)