Hacker News

It is not "clear", as your comment suggests, it's hidden. Which is semantically the opposite of clear. Regarding your theory, might be true, might be false. But it's highly speculative.

They started Glasswing before they struck that $1.25B/month deal with xAI/SpaceX for their (notoriously dirty) Memphis data centers.

So they have a whole lot more compute now than they did last month.

The security concerns argument would have worked better if a forum full of people hadn't promptly obtained access by the extremely sophisticated tactic of guessing its URL...

So why is OpenAI also releasing 5.5-Cyber in a private manner? Are they also out of compute?

Probably. This is an 8-12 trillion-parameter model, which is why it costs so much, that is also a major reason, besides RL and synthetic data, why it suddenly gained these new capabilities. They claim it was not fine-tuned or trained specifically for cybersecurity, but is instead a general purpose model.

how did you go about assessing this?

So you believe one marketing department more than the other?

Social engineering as a problem goes away when anybody can get a model to do it for them for $5. It stops being possible, it's really the bank's problem when they can't have a minimum wage call center or a robot responsible for people's data.

The government should be in charge of ID Provider infrastructure and has local offices (postal) that can establish physical identity (and already do for people who need to travel abroad), but the religiously affiliated NWO conspiracy theorists have made this politically infeasible in the US, so we have unsavory private sector providers like World ID stepping in.

This is just cover for being sore that you don’t have access yet <- see what I did there?

People and organizations can have mixed motivations. It’s often not “just” one thing.

To me this makes little sense — I can’t imagine the orgs they have limited this rollout to don’t already have Claude subscriptions and integrations. And sure this may play nicely into branding a build a mystique around the model but ultimately they are missing out on a ton of revenue and risking being totally front-run now that model performance parameters are out and people have firsthand experience. Feels more like a fairly genuine attempt to be responsible. They could have easily rolled out an update and done some PR to absolve themselves of responsibility

Urgency x scarcity, unbeatable marketing move.

From what I've read so far it's less about Mythos being much better at tasks in isolation.

Security wise, it's about being able to find and chain multiple vulnerabilities to actually create viable exploits.

So I would imagine that if you were using it for regular software development you may not feel that it's that different unless used in a particular way?

No single open weights model comes close to either Mythos or GPT 5.5.

Nonetheless, running many of the open weights models over a codebase, with an appropriate harness, can provide about the same vulnerability coverage (i.e. each of the open weights models would find a subset of what Mythos or GPT 5.5 could find, but the subsets are not the same).

Despite needing more runs and more time, this may be significantly cheaper, especially if the models are self hosted.

Based on what Anthropic said about Mythos, they also use a quite elaborate harness for finding bugs and vulnerabilities, i.e. not a simple prompt like "find the bugs".

They run repeatedly Mythos on each file of the codebase, many times. They start with more generic prompts, used to determine whether a more thorough analysis of that file is worthwhile. Then they use more specific prompts, to detect various classes of bugs. After it becomes probable that a certain bug exists, they do a final run where the prompt requests a confirmation of the already known bug, perhaps together with a proposed patch or a PoC exploit.

Therefore the efficiency of finding vulnerabilities depends a lot on the harness, not only on the LLM. Also, searching vulnerabilities in a big codebase when paying per token is very expensive, because it requires many runs of the LLM.

And all you have to do is demonstrate unique value during the pilot phase!

Err... wait... that was already the hard part... hmm

It’s true that providing security services to so many organizations will likely put them in a position to earn lots of money. It makes them an essential service, sort of like what happened with Cloudflare and denial-of-service attacks. (There are competitors, but they’re the first company people think of.)

But I think that downplays the importance of having a good product. If the product didn’t work, this would be a good way to lose trust with a lot of organizations in a hurry.

With trillion dollars at stake they can hire best of best in sales and marketing. And unlike some hardcore hackers who may have ethics that does not always move in direction of more money. Sales and marketing people are highly motivated for opportunities to make more money.

These companies are surely already onboarded…? They claim like 10k verified and high severity CVEs. Would you have preferred they just rolled it out like another opus update? You wouldn’t be insinuating in that situation that they were careless and reckless? They risk missing a boatload of revenue if openAI front runs them for a public launch. In what world is this some sort of scam??

And put Chris Olah, Anthropic co-founder, sitting next to Pope Leo XIV presenting his first encyclical, Magnifica Humanitas, at the Vatican.

>can't release it

can't release it the plebs

I assume they're using a more candid definition where they're not counting all the countries a company may be based, but rather the primary country they're based in.

I don't think they're trying to flex this as a large number. They don't want to give an exact number, as that may change etc / is fuzzy, but also want to give you an idea of the scale.

They say "In the future, we intend to expand our geographical reach much further". I imagine this commentary is somewhat related to the concerns that AI will create an even worse "global underclass". AI developments are first accessible to Americans, then allies, and then later the whole world.

They're writing it in contrast to the previous scope, which doesn't seem to have been available to any organizations based outside the US. (There was news a few weeks ago about how Japanese banks were going to gain access, but based on the timing I think this announcement is that access.)

How can a patch be "reproducible"? The testcases are reproducible.

Why would it not be reproducible?

Big Blue defeated Kasparov. The Watson hype was about winning Jeopardy, which is still kind of the only use case for current AI.