Three years ago, I said in my talks that generative AI would eventually start discovering zero-day vulnerabilities. At the time, many people dismissed the idea as unrealistic. It is no longer unrealistic.

The clip is from my talk at NBF 2023. In the talk I also do a demo with this new model called "Claude" from a company called Anthropic...

all hail Mikko al-Gaib

The discovery rate going up helps defenders too but only if the patch cycle can keep up. How much of what Mythos found in the last month has actually been patched versus sitting in a coordinated disclosure queue somewhere?

Massive difference between generative AI autonomously discovering 0-days on its own.. vs a fairly decent [human] red-teamer using generative AI to help discover 0-days. Those aren't even remotely in the same universes. But yes, go on with your influencing I guess

It can’t find 0Days by examining code. That’s literally not even a thing.

I have built a CTF for AI:

And if you had done something instead of just talking you would know that it is still premature.

What's your opinion on the Internet Computer Protocol?

I remember those early discussions and how skeptical everyone seemed to be. It is a reminder of how difficult it is to grasp exponential growth in technology.

Not just one or two 0-days, but literally dozens at a time, apparently (if the press reports are correct). Retired software engineer here -- I'm genuinely frightened.

So now we have agents that can find this stuff. What next? With that kind of capability I’m wondering if zero days are just the tip of the iceberg.

They have to be exploitable. Getting a report that shows there is a 0-day doesn’t mean much. What can be done with it is far more important. Or, are there complimentary controls. Not every box sits on the internet with all ports open and no other security.

I'm not dismissing it. I'm enjoying it! <3

Who thought it unrealistic? AGI by definition should be able to find such vulnerabilities. ASI will, or ASI - (AsI), will be able to do whatever it wants with all of cyber security.

i also been saying this for ahwile I built my whole startup recently around this ENTIRE concept. Red Team action-open source Lot of people sat on their hands or didnt take shyt seriously. Now with Mythos...now they're scared😂

Most modern software is so bad that you don’t need AI to discover zero-day. There is little incentive to find them, because is too time-consuming and illegal… The question is: how can we produce good programmers to reduce the amount of garbage, low-quality software?

That’s great news in more ways than one.

Hater gonna hate let the evidence speak for itself

Miksi ne ei löytäisi? Jälkikäteen katsoen osa ongelmista on triviaaleja, samalla tavalla toistuvia. Nehän pitäisi olla malleille hyviä paikkoja loistaa.

What’s changed is making vulnerability discovery faster, cheaper, and harder to defend against.

Great talk

i have quantum braided software.. instantly zero day vulnerabilities could be eliminated. Hacking ended.. everyone enjoys the looping insanity it seems .. meanwhile i get to have fun running proteomics or whatever! The fusion one today was good...

Do you think this is a good development Or does it scare you?

To democratize AI access is the only path moving forward. e.g Oppenheimer.

How many rounds/iterations/generations of: "That's not possible" to "Oh wow?!" ...do we have to go through here?

With powerful new models on the rise like Claude Mythos, there will be no end to the discoveries.

But interesting question which side is gaining more. I'm hopeful it's more important that every PR gets reviewed like this (with full access to code) then hackers black box analyzing "lucrative targets".

were this might lead after few years ?