An initiative to secure the world's software | Project Glasswing

Highlights

• Claude Mythos Preview identifies software vulnerabilities with the same proficiency as a professional human security researcher.

• The model creates sophisticated exploits by autonomously chaining together sequences of three to five independently minor vulnerabilities.

• Project Glasswing provides advanced AI tools to maintainers of critical infrastructure to fix bugs before they are widely released.

• A 27-year-old vulnerability in OpenBSD was discovered that allows a remote attacker to crash any server with a few pieces of data.

• Security testing on Linux revealed multiple privilege escalation bugs where users with no permissions could gain administrator access.

• The AI model demonstrates long-range autonomy by pursuing security tasks that typically require a full day of human effort.

Timeline

1. 00:00 - 00:54

   The magnifying effect of software vulnerabilities

   Daily software users rarely notice bugs because most are fixed before they cause disruption. However, vulnerabilities in shared libraries create a magnification effect where one flaw compromises the security of the entire internet. Traditional security research relies on human speed, which often lags behind the pace of software deployment.

   • A single bug in shared software components impacts thousands of derivative products and websites globally.
   • Manual processes for finding and patching vulnerabilities are historically slow and expensive.
2. 00:55 - 02:48

   Capabilities of Claude Mythos Preview

   The model was not specifically trained for cyberattacks but gained these skills through its deep understanding of code. It demonstrates the ability to see connections between minor flaws that humans might miss, creating an 'accelerating exponential' in discovery speed. Because of the potential for harm, this specific model is restricted from wide public release.

   • LLMs trained for high-level coding proficiency acquire cybersecurity capabilities as an unintended side effect.
   • The model performs complex logic by linking three to five separate vulnerabilities into a single sophisticated exploit.
   • High levels of autonomy allow the model to execute long-range security research tasks that mirror a human's full workday.
3. 02:49 - 04:26

   Defensive advantages through Project Glasswing

   By putting powerful models into the hands of defenders first, the project aims to secure the underlying layers of the internet. Security researchers using the model reported finding more bugs in two weeks than in their entire previous careers. Once a bug is identified, the model assists maintainers in developing and deploying patches to protect all users of the software.

   • Project Glasswing partners with critical code maintainers to find vulnerabilities in operating systems and internet infrastructure.
   • A critical bug present in OpenBSD for 27 years was identified and patched through this initiative.
   • Linux kernel vulnerabilities were discovered that allowed unauthorized users to elevate themselves to administrator status.
4. 04:27 - 05:46

   Securing the digital foundation of society

   The initiative views software as the backbone of modern life, from financial systems to daily utilities. No single organization can manage the total scope of emerging threats, necessitating a collective defense strategy. The ultimate goal is to reach a state where customer data and infrastructure are demonstrably safer than they were before the advent of these AI capabilities.

   • Cybersecurity is now synonymous with societal security because every analog aspect of life is represented digitally.
   • Collaboration across industry and the U.S. government is necessary to assess and defend against AI-driven risks.
   • The project is a long-term commitment lasting months or years to protect financial transactions and critical infrastructure.