[mirekrusin]

If mythos can break into almost all of their classified systems in hours then other models including opus, gpt, gemini and large open weight models can do so as well, maybe you'll have to double hours or it may become days, but they also will, there is no "maybe" in here.

State sponsored, non-public penetration fine tunes (of possibly public ones) likely can do it even faster.

Unsupervised penetration RL loop is ideal setup similar to optimization one – it's relatively easy to gain function on it.

[dualvariable]

Also, this is just security through obscurity. The holes that mythos exploited still exist after you've tried to limit mythos accessibility.

And the fact that all our systems are riddled with security holes shouldn't be too much of a surprise given the way that we all know that software is developed and how tech debt / chores are constantly underbudgeted (plus I think this underscores that any one human's knowledge and attention are inherently limited, and even the best PR review is going to leak all kinds of security holes).

[mirekrusin]

Yes, exactly, quite shocking, if something like this is true, as NSA (!!) director you keep it quiet, right?

[dualvariable]

That is literally just more security through obscurity.

And the threat actors that would find that information "useful" already know it.

All of our IT security is a mess, the NSA director is just confirming what should be common knowledge.

[DANmode]

Not if the existential threat (to your organization’s current setup) is uncontainable.

[johndough]

I don't think that is necessarily true.

- With a weaker model, the time to break into the system might grow so larger that it becomes infeasible, similar to how password hashes can be bruteforced, but if the password is long enough, that is not going to happen in our lifetime.

- There might be problems which are inherently unsolvable with a lower level of intelligence. For example, your dog won't derive calculus from scratch, even if it lived forever.

- LLMs might be biased in such a way that they never explore the entire solution space, no matter how many attempts are made. Some models are notorious for getting stuck in a loop, trying small variations of the same approach every time, even though it is doomed to fail. This can be counteracted somewhat with higher sampling temperature, but that hurts reasoning capabilities.

[BikDk]

The concept of infinity claims that the dog eventually becomes Shakespeare. The same way we handled encryption, even before Alan Turing codes were broken and evolved. Last, it is a huge advantage to have the machine/mind and to evolve from there. P.S. Even if you go back to lemon juice on paper there may be a thief around that knows the trick.

[jjk166]

> The concept of infinity claims that the dog eventually becomes Shakespeare.

The ability to reproduce an exact copy of hamlet does not make one Shakespeare. A monkey on a typewriter may very well generate Shakespeare eventually, but it wouldn't understand Shakespeare then any more than it could immediately. Likewise a dog may put together some string of text that includes a derivation of calculus, but at no time will it be able to apply that derivation to solve mathematical problems.

[gmerc]

And by dog you mean lLM

[cyanydeez]

People seem to think entropy can be overcome with proper focus. Thats why we have things like "effective altruism", the idea that you can ignore all the harm you do on the way to some big grand altruistic act, as if the shattered glass can be reassembled if you just collect enough reverse entropy.

It's a line of reasoning meant to shut off empathy to the here and now. And while it sounds good, along the lines of Baywatch: If you're jumping into a live saving situation and you have to choose between further harming your victim and you being harmed, you choose your victim because without you to save both of you, it's fatal; the difference is indirectly or directly pushing your victim into the water then claiming you're altruistically going to save them at a later date.

It's just delusions to keep moving forware.

[awesomeusername]

Dogs deriving calculus:

https://www.csun.edu/~dgray/BE528/Pennigs2003Dogs_Calculus.p...

[Reubend]

I think you're missing the point. Everything you said is theoretically correct, but the parent comment was talking about the concrete circumstance of pentesting with the top models today.

Let's just take GPT 5.5 and Opus 4.8 as an example. Both are worse than Mythos 5, but they're capable of quite a bit when the guardrails are lifted and they're paired with a skilled human operator. They more than "good enough" to reach the same result with the addition of some human effort.

[mirekrusin]

Mythos and other models are not brute-forcing passwords (and with this analogy passwords, ie. systems are the same).

We're not talking about dogs, but LLM systems.

Mythos is not exploring entire solution space either.

Usually looping is solved by repetition/frequency/presence/n-gram penalties/DRY/min-p sampling, not temperature but we're not talking about small models that have those classes of issues here.

[johndough]

> Mythos and other models are not brute-forcing passwords (and with this analogy passwords, ie. systems are the same).

I am not talking about literally bruteforcing passwords (although LLMs are being used for that, too), but bruteforcing passwords and solving verifiable domain tasks have quite a few similarities, especially when considering rule-based and probabilistic bruteforce methods.

> We're not talking about dogs, but LLM systems.

Well, clearly dogs are not LLM systems. It is an analogy. If there is an important point on your mind that makes the analogy break down, feel free to spell it out.

> Mythos is not exploring entire solution space either.

Yes, but weaker models do not find the solution right away, so they need to try more often. But if they only try the same thing every time, they will never succeed, so we need some kind of guarantee that they try something different every time.

> Usually looping is solved by repetition/frequency/presence/n-gram penalties/DRY/min-p sampling, not temperature but we're not talking about small models that have those classes of issues here.

Those might help to reduce looping (at the cost of biasing the generation), but to guarantee that a model can generate all possible generations, we need non-zero probabilities for all tokens, not lower probabilities for likely tokens.

[1over137]

> I am not talking about literally bruteforcing passwords (although LLMs are being used for that, too)

They are? Seems like a much worse way to brute force that a tight loop written in a compiled language.

[robocat]

PassGPT: Password Modeling and (Guided) Generation with Large Language Models

https://huggingface.co/papers/2306.01545

Although most activity is likely hidden (blackhat or state)