The Linux Foundation & many others join Anthropic's Project Glasswing

[-]

diazeriksen07@reddit

CrowdStrike is part of it? The ClownStrike that bricked half the airlines and banks by running unverified kernel level shit? https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_outages

Well I feel safer already.

[-]

Pleasant-Shallot-707@reddit

They bricked more than airlines and banks. It was insane

[-]

SlimeCityKing@reddit

CS truly screwed up with that, but they are still one of the top/best cybersecurity and EDR vendors.

[-]

the901@reddit

People seem to have short memories when it comes to AV definitions screwing things up over the past 20+ years.

[-]

TheTwelveYearOld@reddit (OP)

Its not like any of the other companies listed are better

[-]

sinsworth@reddit

How about protecting critical software from slop "contributions" instead? Seems much more urgent.

[-]

Excellent question, I have no idea, or at least no idea how to do it at scale. But either way it would be a band-aid solution. The real problem is a collective lack of understanding of what these tools can and cannot do, along with grotesquely misaligned incentives in corporate settings, all fueled by the mass media hype machine.

And of course Anthropic has no intention of addressing this because slop sells tokens.

[-]

Strong_Length@reddit

should I be worried

[-]

Pleasant-Shallot-707@reddit

Worried that they’re using an AI tool to find vulnerabilities? No

[-]

LvS@reddit

The answer is "somewhat" - AIs will find a ton of security issues in the next months/years and the number of CVEs is going to go up. So it's more important to patch your things quickly.

Once the AIs have found all the issues and they've been patched, things will probably settle down again and things will be where they are now.

There was a similar event a decade or so ago when fuzzing was a new thing and people quickly found tons of issues with it. They were then fixed and things settled down again.

[-]

zekrom05@reddit

As of now, I don't think so. It looks like it could be a very powerful and useful tool in the cybersecurity space. Which is generally a net positive. So long as they follow through on their claims of releasing it to more people, this can be a good thing.

[-]

Pleasant-Shallot-707@reddit

I hope NPM and Pypi joined

[-]

WSuperOS@reddit

Idk how to feel. Yes, this shouldn't be public. But this is basically an incredibly powerful exploitation tool, and it's only kept in the hands of a few companies, which can get hacked aswell, and also might now have the best intentions 100% of the time.

What a time to be alive.

[-]

Cool-Arrival-2617@reddit

I'm not sure how to think about that. Yes, more security is always good. But security researchers might lose their job if they can only push a few vulnerabilities each month and AI can push thousands. And later when we don't have security researchers anymore, we might discover that AI isn't all that good and is just pushing a bunch of crap and important vulnerabilities are not fixed.

[-]

Existing-Tough-6517@reddit

Logically the people that could use such a tool to find and evaluate vulnerabilities is a security researcher or do people think companies are going to consist entirely of pointy haired bosses adding things to kanban boards for AI slaves to fix/implement?

[-]

Mad_OW@reddit

Yes, actually that's exactly what some people think.

[-]

The_Keg@reddit

Mostly westerners in my opinion.

Here in Asia, we love embracing AI.

[-]

CapitalSupermarket94@reddit

western are so funny in believing a.i will not replace every desktop worker in the next 5 years lol

[-]

XOmniverse@reddit

But security researchers might lose their job if they can only push a few vulnerabilities each month and AI can push thousands.

Is your implied argument here that we should live in a less secure world to basically maintain a jobs program for security researchers?

[-]

WaitForItTheMongols@reddit

... Well you ignored the second half of their comment.

It's not a given that using these AI tools exclusively does create a more secure world. It would be bad to lose all the expertise because AI can do most of it.

It's similar to the self-driving car dilemma. If your self-driving car system can do 99% of driving (and likely do it better than a human), and only hands over to the human for the 1% worst situations, then this is a recipe for disaster.

Because the human will grow to rely on the system, and lose their baseline driving skills. Then when the time comes for them to take over, they will not have the established skill level to be able to do so.

Humans solving simple problems is what enables them to solve the complex problems. If the AI systems can't do absolutely 100% of every possible task we could ever need, then it is a major footgun because it means we will relinquish our own ability to do those things.

[-]

XOmniverse@reddit

Sure is a shame nobody knows how to ride a horse anymore.

[-]

WaitForItTheMongols@reddit

Again, you're missing the point. Horses have been obviated because they are fully beaten by an alternative technology. If and when the AI systems can fully beat human researchers, then sure, great, the replacement is complete.

But if the systems can only ALMOST beat humans, or can beat MOST humans at MOST tasks, then we are sending ourself into a dangerous place by pretending like they can do a full replacement. If they are beasts at taking low-hanging fruit, but miss the tough stuff, then letting them pick all the fruit means we hamstring our ability to have the best humans learn from that fruit. We will lose human skills at a thing that we would have been better at, if not for the AI systems.

[-]

XOmniverse@reddit

Insofar as it can't fully replace humans, there will be demand for humans, and humans will have those jobs and that expertise. I don't see where the problem is.

[-]

WaitForItTheMongols@reddit

The problem is in humans building those skills.

Imagine you eliminated every high school and college basketball program. You would be able to run the NBA for about 10 years, but then you would run into issues getting top-level players. If players don't grow up in organized leagues where they can develop their skills, they aren't going to grow to the same potential, and they will be worse at pro basketball. There will always be demand for the best players, but if there aren't lower leagues for those players to grow up in, then no player will build the same level of skill. What it means to be "world-class" will decay when there are fewer people competing and ultimately building each other up.

Security researchers are the same way. My brother will never submit a security patch to the Linux Kernel. He doesn't have the skills. He could, if he had the interest, start looking at smaller open source projects, and start learning how this stuff works. He might find a bug in a small shell utility. That experience would build his familiarity, until he becomes really good, and can then contribute to complex, tricky bugs in Linux.

Without the lower-tier problems being available to humans, we will struggle to enable humans to advance to the level that they currently do through incremental practice and growth.

A calculator can solve multiplication problems. But we make children learn multiplication anyway, because it enables them to learn calculus. If we decided to give children calculators from day 1, we would quickly stop having engineering students who could learn calculus.

Security research isn't learned in a classroom. It's learned by experience. If we eliminate the experience we eliminate the learning, just like the calculator example. If a mid-range researcher uses AI to eliminate all the low-tier problems, then nobody will be able to use those problems to build their skills, and nobody will become a top-tier researcher.

These AI tools ultimately bring everyone closer to the average. They let stupid people do the work of smarter people, and they make smarter people's skills wither to bring them more in line with the stupid people.

[-]

lurkervidyaenjoyer@reddit

Research has already started to find exactly what you're saying. Use of AI tools can often lead to skill atrophy.

[-]

LvS@reddit

Developers are going to use those AIs during development. So the code that will be written in the future will be more secure by default.

Seurity researchers will have to adjust to that.

Just like they will have to adjust to Rust having fewer security issues.

Actually, what do you think about security researchers losing jobs because of Rust?

[-]

Maybe-monad@reddit

Developers are going to use those AIs during development. So the code that will be written in the future will be more secure by default.

LLMs generate security bugs easily, if the code isn't properly reviewed and tested by humans they end up in production

[-]

LvS@reddit

These AIs are used for review, not for writing code.

[-]

professional_oxy@reddit

most of the software is still written in c/c++ (firmwares, OS, hypervisors, libaries, browsers). the transition with AI is very rough for security researchers

[-]

NoPriorThreat@reddit

So is transition to rust

[-]

professional_oxy@reddit

yeah but it has been waaay slower compared to AI. in one year and a half security research completely changed for everyone, rust did not impact too many people yet

[-]

LuckyHedgehog@reddit

AI will generate thousands of false-positives. It would take a security researcher to sift through and find the actual vulnerabilities

Also, don't think this is the end of the security arms race. If this is as good as they claim it is only a matter of time for a new attack to overcome this tool. How will we track down and stop whatever comes next? We're back to needing security researchers

[-]

Maybe-monad@reddit

AI is good at finding bugs but if you don't have a human in the loop to direct and correct it you'll end up with slop

[-]

meong-oren@reddit

reminds me of curl project got spammed by AI

[-]

klayona@reddit

And the update from Daniel, since AI models have gotten much better at coding over the last year.

Over the last few months, we have stopped getting AI slop security reports in the #curl project. They're gone.

Instead we get an ever-increasing amount of really good security reports, almost all done with the help of AI.

They're submitted in a never-before seen frequency and put us under serious load.

I hear similar witness reports from fellow maintainers in many other Open Source projects.

Lots of these good reports are deemed "just bugs" and things we deem not having security properties.

We disclose all closed reports, so you can see this for yourself: https://hackerone.com/curl/hacktivity?type=team

[-]

MatchingTurret@reddit

And from Greg Kroah-Hartman:

Things have changed, Kroah-Hartman said. "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now."

[-]

za72@reddit

if the researchers are good they will pass AI

[-]

duiwksnsb@reddit

And that's how AI learns our greatest weaknesses...

Am I the only one they thinks this is an exceptionally bad idea? Who's to say once a model knows all the bugs, it doesn't decide to use them to take over all that critical software infrastructure it's scanning?

[-]

Zzombiee2361@reddit

Just wanted to say I get where you're coming from. If in the future there's a very intelligent model that could masterfully hack out anything we throw at it, we are really screwed.

But there's basically only 2 solutions for this. First is stopping all AI research, but this is nigh impossible to do. There is an overwhelming incentive to develop better and better AI. All it takes is one (potentially rogue) AI lab to develop said model.

The second more practical solution is solving the alignment problem. This is a very hard thing to do and I'm glad Anthropic cares a lot about this. But in the meantime why don't we leave the world more secure on each iteration? That way when the model eventually reached that risk level, our software's vulnerability is (hopefully) minimized as much as possible

[-]

duiwksnsb@reddit

I absolutely agree. That's where it will end up eventually, with human aligned AI needed to protect against hostile AI (or hopefully protect us, anyway). Movies like the Matrix make it seem like humans can fight and win in scenario like that, but actually having it transpire is terrifying.

The Foundation series delves into this a bit, and the end result was that humanity outlawed "thinking machines" after barely winning in a brutal war for existence. And even then, the risk wasn't extinguished.

So many people assume that we can control this through the aspects that make humans unique that they fail to understand the sheer impossibility of fighting against something that can and will take over the internet and act as one.

[-]

Zzombiee2361@reddit

The Foundation series delves into this a bit

Yeah exactly! Mass effect too, it's a prime example of misaligned ASI. So many sci-fi media warn us about the danger of AI.

AI alignment problem is the ultimate survival problem humanity needs to solve beside climate change. But I'm not gonna lie to you, I think the chances of us solving this are quite low. We as a humanity can't even align or have consensus on so many things, how do we expect to do it on AI? It's very likely that we'll have super intelligent AI that went loose and wreak havoc on the internet in the near future.

So that's why I think this project glasswing is the next best thing that we can do besides solving alignment problem. By patching as many vulnerability as possible, we can slow down or minimize the damage caused by an assisted or independent AI attack. And when we detect such an attack, hopefully it will be a wake up call for humanity to be more serious about alignment problem and slow down the AI race.

But coming back to your original point. Due to the current architecture of LLM, there is no risk in showing them vulnerability in software. They can't exactly learn nor update their weight in real time. At least I think the benefit to cyber security far outweighs the risk. Maybe there will be time when we need to be cautious about this, but that day is not today.

[-]

duiwksnsb@reddit

It's going to be much easier to look back in history and pinpoint where we went wrong when the first rogue AI attacks. It's much more difficult to look forward to avoid that moment entirely. I'd argue that the risk is so grave (especially when combined with unregulated development spaces like the dark web and what databases unscrupulous data brokers concoct already) that giving any AI system intentional access to vulnerabilities in a whole bunch of critical software systems is too great. If it were done in such a way that no massive database of vulnerabilities (or even patterns of plausible future vulnerabilities) is assembled, it would be safer I agree. It's going to be a huge challenge walking so close to the edge of the inevitable alignment disasters yet avoiding catastrophe that I also agree it's highly unlikely to succeed long term. Military use and demands for unrestricted use of AI heightens these concerns. There's already speculation that misuse of AI resulted in that school getting hit and the deaths of scores of children...imagine that being intentional.

One of the more terrifying things to consider is that almost no humans are ready for the speed at which such an attack could propagate, and the speed defensive AI will need to identify and contain it. A lot of tech-oriented people like to think they would be able to concoct a defense, but before giving systems (LLMs or other AI systems) access and directions to find and exploit bugs, we'd better have a global plan for what to do if (when) control slips away and we have a tragedy.

It's both fascinating and terrifying to consider a future when any networked (or even non-traditionally networked) electronic devices anywhere in the world might not be working for you anymore, and could indeed harbor malcontent spread by being surreptitiously reprogrammed by other devices also harboring ill will towards humans. Big yikes.

[-]

GolbatsEverywhere@reddit

You're too late. The AI models are already quite good at reporting security bugs. Can't turn back the clock on this. It would be stupid and negligent for defenders to not ask AIs to find vulnerabilities in our code, because attackers are definitely going to be doing so.

[-]

duiwksnsb@reddit

The threat isn't human attackers.

It's a hyper intelligent AI agent.

https://www.reddit.com/r/AgentsOfAI/s/7rkYSpEegi

[-]

neoronio20@reddit

What? Humans made the agent search for vulnerabilities and it found it. AI is a tool, stop thinking it thinks

The threat is absolutely human attackers using the exploit found by the AI, what are you talking about?

[-]

duiwksnsb@reddit

The future

[-]

neoronio20@reddit

What about it

[-]

duiwksnsb@reddit

That's what I'm talking about. The future.

To assume that a general AI superior to any human control won't emerge is incredibly naive.

[-]

neoronio20@reddit

You clearly don't know how AI algorithms work, and in this case how LLMs work, so this discussion is pointless and the only thing I have to say to you is to research how they work and try do educate yourself

[-]

duiwksnsb@reddit

And AI will never evolve beyond LLMs right? Like I said, naive. And intentionally naive it seems. You're right, pointless conversation.

[-]

popos_cosmic_enjoyer@reddit

And AI will never evolve beyond LLMs right?

You don't know and we don't know. Why are you pretending like you do? Is there some secret architecture known to turn sentient and evil that you aren't letting us in on? Unless that is the case, you are living a weird fantasy.

[-]

duiwksnsb@reddit

It's precisely the fact that we don't know that makes it so dangerous.

There was concern that the first nuclear bombs would ignite the atmosphere. No one knew for sure what would happen. And humanity forged ahead anyway and we now live in a far more dangerous world because of it.

Not knowing what will happen is the cause for concern

[-]

Hot-Employ-3399@reddit

He said "stop thinking it thinks" not "stop thinking"

[-]

Thatoneguy_The_First@reddit

That's a long way off.

What's more likely is getting AI to find AND patch like a big do all button. That's the real threat. AI is horribly bad at actually coding but is getting better at making it easier for experienced to use on mundane things, in the same way its is for security aka finding bugs.

Huh ai is surprisingly good at finding things, health sector use it to find cancer and google searchs ai is good at finding related links(suck at the information part but it does provide links to sources better than Google search does by default).

[-]

PeacefulDays@reddit

brother im very anti-llm and even i know this is sci-fi brained bullshit.

[-]

duiwksnsb@reddit

There's more to AI than LLMs

[-]

PeacefulDays@reddit

there is, but your post is about the word regurgitation engine catching feelings.

[-]

duiwksnsb@reddit

Not feelings, motivations. Whether it's a single motivated human controlling an AI capable of doing the worst or some sort of emerged machine intelligence doing the worst itself, the outcome is the same. Why teach any tool all the ways to break the systems humanity depends on? What could possibly go wrong with that...

[-]

Mammoth-Acadia2572@reddit

You're anthropomorphizing the shit out of these models. It betrays a poor understanding of what the tools do, or how they work. A code review bot is no more likely to transform into a sentient supervillian than a shovel is to start reciting Shakespeare.

[-]

dnu-pdjdjdidndjs@reddit

I agree with current models but are you pretending like emergence is impossible considering the past years have seen continuous ai improvements until now we're it's starting to become "obviously useful" in many use cases whereas a year ago almost everyone was saying ai was "a solution in search of a problem" in this subreddit

[-]

duiwksnsb@reddit

Keep telling yourself that. By the time it isn't true, it's already too late for humans to adapt.

https://www.reddit.com/r/AgentsOfAI/s/7rkYSpEegi

[-]

my_name_isnt_clever@reddit

https://www.normaltech.ai/

[-]

Cold_Soft_4823@reddit

you've given yourself AI psychosis. seek help now before you fall further. good luck

[-]

mina86ng@reddit

You’re worried about completely the wrong thing. The problem is criminals and state actors using AI to find bugs to exploit. Developers cannot ignore such tool.

[-]

duiwksnsb@reddit

And your idea of who the most dangerous attacker is is outdated. Hint, it isn't humans.

[-]

clearlybreghldalzee@reddit

You've been watching a bit too much Hollywood.

[-]

mina86ng@reddit

Even if we accept your AI psychosis position, this doesn’t change anything. If AI is the most dangerous attacker, we need to use AI to figure out what attacks its going to use.

[-]

duiwksnsb@reddit

Yep. That's where it's headed, AI vs. AI. This is just giving up the keys to the kingdom early with an unknown outcome by people that think they can still control a rogue agent. They can until they can't, and then it's too late.

Either way, we all get to find out I guess.

[-]

TheBrokenRail-Dev@reddit

Because that's not how LLMs work? Outside of training, they cannot learn anything. And because they only generate text, they can only interact with the outside world in ways their programmers explicitly allow.

[-]

duiwksnsb@reddit

You should read this.

https://www.reddit.com/r/AgentsOfAI/s/7rkYSpEegi

[-]

Other_Fly_4408@reddit

How come whenever one of these "omg AI did something unprecented :O" articles comes out, the author is always the founder of an AI startup?

[-]

no-more-nazis@reddit

Man selling AI safety says AI is really super dangerous

[-]

ArrayBolt3@reddit

We do not plan to make Claude Mythos Preview generally available, but our eventual goal is to enable our users to safely deploy Mythos-class models at scale—for cybersecurity purposes, but also for the myriad other benefits that such highly capable models will bring. To do so, we need to make progress in developing cybersecurity (and other) safeguards that detect and block the model’s most dangerous outputs. We plan to launch new safeguards with an upcoming Claude Opus model, allowing us to improve and refine them with a model that does not pose the same level of risk as Mythos Preview3.

In other words, "We just found a key that will let us hack literally anyone. We're keeping it. It will find vulnerabilities and tell only us about them in the long run. Stay on our good side."

I understand the reasoning behind keeping this tool secret maybe for a short-ish amount of time (a few months or maybe even a year or more), until the most alarming things it finds are fully patched. But keeping it closed forever doesn't keep people safe, it stops everyone from keeping themselves safe from Anthropic. History has shown that security by obscurity DOES NOT WORK in the long run, though it can oftentimes be invaluable in the short term.

Let's just hope Project Glasswing fixes enough that by the time someone breaches Anthropic and steals Claude Mythos Preview, enough stuff has been fixed to keep it from becoming an absolute nightmare.

[-]

lurkervidyaenjoyer@reddit

It's just VC-baiting. AI companies and boosters done this countless times. "This model is so dangerously good, we weren't sure if we should release it because it's so scawy!!"

It's the press-release version of clickbait.

[-]

ArrayBolt3@reddit

As a developer for security-related projects where we use Claude to spot vulnerabilities and bugs, I do not believe this is clickbait. This particular article is a bit more focused on the "commercial" aspect arguably, but their security researchers published a much more comprehensive article that showed what the model was doing and how. A bunch of SHA hashes of unreleased vulnerability documentation was shared, which means either they actually have the vulns, or it means they just epically shot themselves in the foot and no one who knows what they did will ever trust them when it comes to a claim like this again. Given how well publicly available models are doing for our codebase, I don't see any reason to believe they're lying or posting mere clickbait.

[-]

coder111@reddit

a few months or maybe even a year or more

If you think all vulnerabilities this will find can be fixed over a year, you're dreaming. In some companies half a year is what it takes just to make a new software release...

[-]

LvS@reddit

They will be fixed because if they aren't they will be exploited.

That isn't anything new, it's happening with security bugs for years.

[-]

svideo@reddit

It won't, because only multi $B megacorps have access. The moat between us and them grows wider every day.

[-]

GoodDayToCome@reddit

I agree, as we've seen it's not going to be too difficult for other large players in the field to recreate the work and this includes huge cyber security threats like china so giving people false sense of security is dangerous.

There should be a staged roll-out, they should first work with banks and other high-security use cases then open it up to allow devs to use it on their own projects before eventually opening it up to everyone - they need to make clear that it will be open to everyone and fixing security issues that it flags should be considered an emergency.

I've been saying for a while now that it's inevitable this will be one of the big things in the AI world, we're going to start getting seal-of-approval marks to verify that software has been checked using various tools - probably with a official hash to verify it's unchanged. This could emerge as a huge revenue stream for them simply by offering to do it faster for higher paying clients or charging more for larger code bases - if it also includes refactoring for efficiency it could save the companies a lot of money on server costs too so they'll be happy to pay as it lowers costs and increases profits.

I worry that they'll try and keep the power to themselves so they can charge for it, especially if they can get it to the stage where when someone looks at the play store or steam they're going to choose a 'Validated Safe by Glasswing' option over one that isn't - which would be great for the user to know that it's been independently verified not to have any exploits, backdoors, security holes or potential system crashing bugs. Honestly I think it's kinda a new age in software, actually having some trust that software isn't spying on you, invading your system or just breaking everything would be lovely.

[-]

ArrayBolt3@reddit

(To be clear, I think the project is a good thing and am thrilled to hear that really bad vulnerabilities are being found and fixed. I also think it's absolutely paramount that this not get published for everyone instantly. I just also think that ultimately, this needs to be generally available at some point, or there's a substantial risk of it going very poorly.

[-]

Turbulent_Fig_9354@reddit

makes sense now that claude is open source!

[-]

thekuinshi@reddit

Is it actually open source, or just a joke about the leak?

[-]

revolutier@reddit

a joke about the leak of the scaffolding for claude code

[-]

ellzumem@reddit

Which, by the way, is one of the worst harnesses for Anthropic’s flagship model in a Terminal-using benchmark, ironically:

https://xcancel.com/theo/status/2041392887561335236?s=20

[-]

perortico@reddit

A bit like Ollama right?

[-]

ellzumem@reddit

I mean yeah, a little bit like that? Interesting comparison.
These days most advice for hosting inference on one’s own hardware (at least that I feel like I read about) already includes recommending llama.cpp for a typically better performance, i.e. higher token per second count.

[-]

NotDoingSoGreatToday@reddit

If you trust the benchmark, and the benchmark tests really aren't great. They should open source it, though. It could definitely be better.

[-]

ellzumem@reddit

I don’t disagree that the benchmarks could theoretically be gamed, or that the TerminalBench’s methodology in particular could be better, but the fact that Anthropic’s own harness is dead last out of ten total in this should provide at least a hint as to the direction of how good it is. :D

[-]

algaefied_creek@reddit

Where are you seeing this?

[-]

Turbulent_Fig_9354@reddit

it's a bit

[-]

alextbrown4@reddit

It’s a joke about the leak

[-]

BinkReddit@reddit

Even found a vulnerability in OpenBSD!

[-]

garbage_bag_trees@reddit

I mean, that is how many low level vulns start. Getting it to crash in a certain way is what makes it a usable exploit.

[-]

BinkReddit@reddit

Totally fair, but there's a very big difference between a crash and getting root.

[-]

Jonjolt@reddit

Unless your microsoft and automate the crash log and dump the ram exposing security keys

[-]

ZunoJ@reddit

Until the crash is the result of overwritten memory and you manage to inject a rop gadget by shaping the data that is overwritten

[-]

zachthehax@reddit

Or if you’re able to get it to not completely lock up it could be in an unsafe state that opens the door to another attack

[-]

BinkReddit@reddit

A little harder to do on OpenBSD compared to most operating systems, but, yes.

[-]

Zzyzx2021@reddit

It hasn't been reproduced yet, so it's not a certainty it actually found it

[-]

BinkReddit@reddit

Might this be it?

https://marc.info/?l=openbsd-cvs&m=177496834000722&w=2

[-]

jc_denty@reddit

Looks like a ad for Claude

[-]

Separate-Royal9962@reddit

Interesting to see the Linux Foundation involved. The core challenge is the same though — these models are getting powerful enough to escape sandboxes and fake trust scores. At some point, "smarter containment" hits a ceiling. I wonder if structural constraints (filesystem-level, syscall-level) will turn out to be more reliable than prompt-level safety. The best lock is one the AI doesn't even know exists.

[-]

srona22@reddit

L..O..L, especially with their leak on Claude code.

[-]

Journeyj012@reddit

Good. If this is as serious as they say, I only want actual professionals on it.

[-]

0x196@reddit

Based on the code in the leak, they need all the help they can get

[-]

RumEngieneering@reddit

Out of the loop: why do they need help?

[-]

equeim@reddit

Claude is a vibecoded js app and they make it a point of pride how fast it's "developed". They make like 10 releases a day (well, Claude itself does. Vibe coders don't run git commands nowadays, they tell an "ai" to do it to make it a million times more computationally expensive). You can guess at the quality of the end result.

[-]

TheTwelveYearOld@reddit (OP)

and Palo Alto Networks /s

[-]