Mythos is not the AI Apocalypse

is Mythos indeed super dangerous? Welcome to Threat Talks. My name is Lieuwe Jan Koning and here from the Cybersecurity Center of ON2IT, we bring you the next episode of Threat Talks. and the subject of today is Anthropic's new model, Mythos.

Let's get onto it. Welcome to Threat Talks. Let's delve deep into the dynamic world of cybersecurity. Let me introduce our guest.

returning guests of the show. Rob Maas, Field CTO of ON2IT, welcome. His job is to make sure that... bad things do not happen for us and for all our customers.

And today we're going to talk about the Mythos model that landed in a slightly different name, Fable, recently. And of course, there's been a lot of us around it. Rob, welcome. Thank you.

We're going to peel this thing off and see what it's actually about. Let's start off with what it is. Can you explain? Yeah, so Mythos is a...

a large language model like Opus is and also maybe more familiar for most people at GPT. which means it just generates. text. one token after another.

But this one is really big and can do it very thorough on, especially on code bases and looking for security vulnerabilities. Yeah, and it's built by Anthropic. Of course, there's a couple of big cont enders. Indeed, we have OpenAI.

We have Google that has those. Facebook has models, Meta. And this one is the latest model of. - Anthropic.

- Anthropic, yeah. So, and there's Mythos and there is Fable now. I mean, Mythos was in Nuremberg and now there's Fable. Yeah, so MySOS was released in April 16th , too.

a specific set of companies that had access to it. It was called Project Glass wing. And they did that because they said this model is so... strong on finding vulnerabilities.

It needs to be secured and not being in the public. So that's where it started. And with Project Classwing, those companies could use that model to find vulnerabilities in their own software. to make us safer.

Now a few months later. They decided, okay, we are going to release Mythos for the. broader audience so we make it publicly available. but we have a lot of safeguards around it .

So you can simply not ask for. Well, I would say security. questions because then it will flag that as unsafe. and it will not execute your prompt or it will fall back on the Opus model.

But is it really that much better? I mean , we have opened 4.a. I mean, I believe when Midas was released to this select group of companies.

We were at open 4.7, then we got 4.8, which is already an improvement. How do they stack up?

Has always. For a lot of people, it's really hard to compare. So Fable is just released. So we try of course to test with it, but almost all security questions are flagged as unsafe.

So that's really hard. - Although we are, as onto it actually, in a special program that exempts you from these restrictions, but they're still there, right? - Yeah, still you get quite often. - Relatively unusual, unusable.

- They probably are going to tailor it a bit more and a bit better, so less false positives. But if you look at... We have to re- record this episode before it airs, probably, right? Yeah.

But AI reality. If you look at Mythos... then it has found a lot of vulnerabilities. It was also in the ISIL report, it's doing a lot of pen tests and CTFs.

and it's coarse really, really high. So there's a certain truth in their claims that it is really a strong vulnerability or pen testing, a large language model. - It did find a lot. I mean, for example, Palo Alto Networks was in there, and here in the Security Operations Center, we've been super busy with patching everything that they...

did in the last couple of weeks. Yeah. Colonel problems. So I think one of the most noticeable ones.

was a vulnerability in FreeBSD, which is an operating system that's well known for being really, really secure and really... hardened. And that filmability was already there for 23 years, nobody spotted it. Um, Maybe you can argue how bad it was.

But the fact that it found it means that it does a really good search on, hey, what can go wrong with this code base? So it's capable of looking at source code . and then figuring out ways to abuse. the code that's written there to gain root or whatever it is.

- Yeah, that's the main purpose of the model. - And like you said, it's really good at coding, right? It's the... Yeah, we still need to figure out if it also can write code well, but it's pretty good at examining code and finding vulnerabilities in there.

Yeah, I played around with using it for code as well. It is very good, very expensive though. >> Because it's a pony so many. So many different agents.

Like you said, if you want to find a book in VBG, you need to walk so many angles at the same time. And that's what really spawns a lot of, a whole swarm, actually. Alright There's a thing called the AISI test. What is that?

- Yeah, that's the pen test report I was referring to. So what they do is they take a large language model. and they give all kinds of, well. band testing exercises and also throw a lot of CTFDs at it.

So CTFDs are. Normally are games where you participate in and capture the flag and you need to solve. security questions. Aimed at humans for fun, right?

Aimed at humans, yeah. In this case, Mythos was really ... I don 't know the percentage by head, but ... It was really capable of solving almost all the challenges in these CTS as one of the first.

large language models. Yeah, but in. Ample time. Compared to a human, huh?

Yeah, yeah, yeah. But it's still different. What's the fallout of this? What does it mean?

Yeah, that's the question we're still... looking for an answer to. So we know now that vulnerabilities are being found by this model. still quite in a closed group with Project Glasswing.

But eventually, other models will do this as well. And eventually, I think it will also get less and less safeguards. So that means. that we need to protect ourselves and.

doing a better job at protecting ourselves as we did in the past. I think a good example here is the zero day clock. They keep track of how long it takes from finding a vulnerability. till it can be exploited.

And it used to be, if you look back, I believe 2019, it was over two years. and we're now in a timing of one day. And they expect it next year that it goes to one hour. So it means you find a vulnerability or possible vulnerability.

And within one hour, you can exploit that vulnerability. So that's a massive shift that we need to take to protect ourselves against that shift. That means if you rely on patching quickly enough... that's going to completely change how we should do patching then.

I mean, we talk about how to... fortify yourself against this new... Speed of attacks. in a minute, but if patching is your current answer.

Especially if it is a patching cycle of 30 days. That's not going to fit. Then you will fail. Yeah.

>> Honestly, we sometimes have discussion with customers. They want us to. get us a stable release for the year for a firmware of firewall, for example. I mean, that's...

Yeah, so we definitely need a different, well, maybe it's not a different strategy , but if your current strategy is, I do 30 days on stable patch windows. You need to change that. That's not going to hold up, especially not on the edge devices or devices that are publicly available from the internet. But that means that vendors also need to ...

improve the testing tremendously, I mean, because they will. I have to patch in a hurry. What about quality then? I mean...

Yeah, that's your website depends on it or your energy. Factory. relies on it. Yeah, especially, of course , again, for the edge device, because everyone.

can test them out. But this is also one of the reasons they started Project Closwing. So those vendors like Palo Alto Networks and Microsoft. have the opportunity to test our own software against Mythos.

to see if there are any vulnerabilities, so. they should know first. and then they can bring out a patch before others know about it. - Yeah, but it's a Slack group, and like you said, these models evolve, so there will be an open source model, there will be a Chinese model, there will be - - Yeah, it's a little more common, yeah.

Publicly available, more common. - Yeah. So yeah, now they still have time. But I think what you're saying is that...

The patch hikers need to be quicker, et cetera. Yeah, it's not only patching. I think if you solely rely on patching, you're going to fail anyway. Patching is really important, especially for the Edge devices, but there are so many.

things you can do more to protect yourself better. I've talked about this before about the importance of patching and what we land on is. in certain areas. This is all you got maybe like your phone or indeed your devices in mount VPN.

endpoint, for example. patching is still super, super important that you do this rather quickly there then. Yeah. Yeah.

But even for those systems on the Edge, there are multiple other ... measures you can take. to get better prevention even if you cannot patch it quickly. Okay.

Well, get into that before we do that. You wrote a blog post recently and you referenced the CSA paper that was about Mythos. Can you talk a little bit about that? Yeah.

So the CSA paper is called Mythos Ready. Um And it's a really good paper because I think it really... sticks to what we already know. Um and really looks into what's actually really happening, no marketing.

But just, hey, this is the model, this is what we have seen, this is proven. and this is what we can do. And it basically pulls down to. you should do basic cybersecurity hygiene , which you already should have done.

Uh, but the essence of doing it now. is becoming more and more. urgent because the exploit time will drastically being reduced. So that's the core message of the paper.

And in the blog post, I take a look at the five. things that you really should check or get in order. Uh... to be Mythos ready.

And the blog post title was, these are the five things any CISO needs to check before going on holiday, because we assumed the model would come out. around the summer, but after just one day after I published that blog post, Fable was being released. We still need to do the measures, but you don't have to till the summer. >> Yeah, okay.

Should we should re-title it maybe? - We can, we might do that. - Last time again, then we thought we would have, yeah. So, Keith, tell us a little bit about what...

what's in there because there's a thing called phone ops that's that is coined, right? The importance of egress filtering, those kind of things that those are. Yeah, those will come back. Well, from upside down.

It's not necessarily a new... process, but it's a new name to bring it back to attention. It's every process around your vulnerability management and patching, of course, is one of them. segmentation is one of them, authentication.

So you have a couple of things that you need to do to make sure that you are protected against these vulnerabilities. Well, in the blog post I named five. You came up with an acronym. It really am used me, honestly, because it's Fable.

F able, like we said, it's the version that is now to the public, which is more or less mythos with extra safeguards around it that are very annoying to security people, I might add. So yeah, let's, so we have the F, the A, the B, the L, the E. - Yeah. - Let's start with the F.

- Yeah, the F is finding everything you have. So you need, it's the same as with zero trust. You need to know what you have to find your protection, step one. So if you don't know what you have, it's really hard to protect it.

So that's really step one, find everything you have. And if you have just limited time or. troubles with it, then at least make sure you find everything that you have at the edge. So that you at least start there with your inventory.

So that's what the app is all about. So just know what you have, what you need to protect. It plots a lot on the first step of your trust, I would say. Yeah, it's more or less the same.

Define attack services. But now the focus, what I would say, is start at the edge because that's where the attackers, in this case, will come. Know where to prioritize. Okay.

Um... The third letter is B. I have a personal preference to start with that one. Yeah, that's bound to blast radius.

It used to be segmentation, but there was no S in fable. So I went with the B. But the whole idea here is that... If things go sideways, even if you have a very good patching process, you patch even in a few hours after the patch is being released, you still can have the unfortunate experience that you are being hacked.

then you need to make sure that you can isolate what happened. And what we still see a lot today is that all Edge devices, whatever function they have, are all put in one big segment called the DMZ. But that means if one... Uh...

asset or server is being compromised. that the attacker from there can try to move laterally around within the DMG. And often the DMG connects back to the. a LAN with some service to get data or whatever region.

So it's not a very good protection. Also what Sarah Triss said, you should function on protect service, which you really need to protect. You're probably linked to your business. use cases.

and then protect the edge service in their own segment. So if it goes wrong. then the attacker cannot move laterally around. Yeah, letter movement is a big thing, always still is.

And segmentation really is the key to this. It was already the big thing because attackers went for the clients. But now with these kinds of vulnerabilities and the exploits, they also come from outside. What about the egress of traffic in this respect?

Yeah, also very important. So if an attacker comes in, make sure that... Bye. If Lord4j is still, I think, the best example here.

Log4j in itself wouldn't. Yeah. Remember Log4j was this vulnerability in a log library that almost everybody uses who makes code in Java. and it contained the vulnerability and it was in all products almost.

Yeah, it was almost every organization. If you did your cyber hygiene well. - Right. But yeah, you would still be vulnerable for that attack.

But it cannot be completed because what would happen is the attacker would gain access to your machine, but the machine needed to download a Java library from the attacker server. So if you have... proper segmentation and proper egress filtering. You could say, okay, but this server is not allowed to go to any other address except this.

that I really, really need. So specifically. - Yeah, there's no reason why any Java application should be able to dynamically install a library, but yet that was the situation back then. - Yeah, exactly.

- Because of no eager filtering on apps. - And that's also what we still see quite often. Oh, this is an edge device. It's free to go to the internet.

So limits your egress filtering there. Let's go to the second letter now, the A. Yeah. That's authentication, authentication everywhere, and especially multi-factor authentication.

Um, it's, it's, uh, well, if you just have basic authentication, meaning a username and password and a brute force attack and even. with the large language model, it's really easy to bypass. But if you add that one extra factor, so multi-factor, it becomes much and much harder to bypass that before. you can find the vulnerabilities.

This is of course only true for vulnerabilities that are. after your login process or after your. guarded wall. Um, but it's a really important step to make.

make it really hard to get behind that first step. - Yeah, because ideally your attack surface is very small before authentication. But once you're authenticated, there's much more opportunity because there's much more functionality. That's how it should be set up in every application.

Therefore, it's a very powerful tool that you have if you make that airtight. What about the lifetime of those identity grants? Yeah, make them as short as possible. Because if they are leaked, then of course they can be abused and with this use of AIs.

They can be used in a very quick way and retrying, et cetera. So make them very short. So you can say, I have an access token in my browser, for example, that's valid for 24 hours. You could get away with that in the pre-M ythos.

Yeah. Because a human is not that fast. It's actually doing it in minutes. So exactly.

Exactly. Yeah. And then it rotated a lot then. And our application is ready for this.

I think most of them nowadays are, we already. talked about multi-factor attendees for quite a long time. Short-lift tokens and keys. much less because we're not used to having short-lived keys.

We're getting more and more, even with certificates, but we should even get shorter. I remember that. lots of discussions internally and we actually. Because the problem is you don't want to bug the user every minute to authenticate , right?

That's always the challenge here. What we landed on is that we have a layer in the middle actually that has a longer lift token, but all the applications behind it. I have a very short one, so the application will constantly authenticate against your identity server. At least lessen it.

Those kind of things. But I don't see that often. Almost never actually. Okay.

Okay. Fourth letter of f able is the L. Yeah. That's the limit exposure.

- Limit exposure. - Yeah, and what we mean by that is that you need to. It comes in multiple forms, but first of all, I would say, make sure that your firewall is completely cleaned up. No in- use rules, etc.

Only the rules that are really needed to expose your services. But also on the service itself, make sure you have hardened software or hardware. which means don't run any... processes that are not needed.

Maybe scale down your OS where you can, remove and use features. Because everything that's running can be an attack factor. I always think that the Thales Kubernetes system here is a very good example of this. It solely runs Kubernetes, it's API driven, there's no shell on it.

- Yeah, it's a Linux distro that's super. that its purpose is to be... - Yeah, running containers, more or less, and only that. So there are no additional services running.

which limits the attack surface, so make it really hard. If you run, let's say you run a web server, but on that web server there's also a shell running. If the shell contains a vulnerability, you can be attacked on that shell instead of on the web server itself. So.

Limits. The exposure of all the services, make sure they are not running at all. and then they cannot be exploited. Yeah, in favor of a single binary.

I mean , if you use Golang or REST or something, you have no operating system anymore to run, right? Yeah, the less the better in this case. This is more. Yeah.

F-fifth letter? The E? That's eyes on everything. It's more or less the same as zero twist step five, monitoring.

So make sure what's going on, see if there are any abnormalities in your environment. so you can quickly react if you see anything going on. How quickly do we need now? Yeah.

as quick as possible, I would say. And we have the tools and we're getting the tools, tools are getting better and better. So for a lot of things, we can use automatic responses. Especially also with AI, so if it is critical enough, try to mitigate it.

as early on and even automatically. - So that means that if we see an attack somewhere or a compromised host or so, we need to ... within. Seconds, minutes, hours, days, put that on the blog list, isolate the host.

I would say aim for seconds, but in the end it will be kind of minutes, especially if you have commit times or human in the loop. but we should act as quick as possible. Can we have a human in the loop? There's always the debate.

If it is a very critical production system, you have to make the trade-off. Do I go for the false positive once in a while? and be secure, most secure, or do I have human in a loop with the chance being a little bit too late and having damage on the inside? Yeah, but if it gets down to minutes, there's never going to be a human in a loop within a minute.

No, that will be really, really hard within a minute, but you can make it very short if you have a 24/7 sock, for example, eyes on the screen, and if a P1 pops up, that there's an immediate action. But ideally you will do it automatically because human can never beat that. Clear. So if we...

conclude whether this mythos is a myth or reality. What would you say? Um I think there is truth in what Anthropic claims. I don't think it is as bad as they claim that it is.

because we can take a lot of preventive measures, which we should already have taken. But if you're still lacking some of these measures, then the time to act is now. because the model is already released. So I would say get started.

- No time to waste. - No time to waste. - Okay, well. on that term.

Thank you very much. for explaining all these things about mit os and demystify it a little bit. And to our users, thank you very much. If you made it this far in the episode, please award us with a like and subscribe.

We'd appreciate it. It allows us to spread the word further. And... Next week we'll have a fresh episode for you in your inbox.

So hope to see you then. Bye bye. Thank you for listening to Thread Talks, a podcast by ON2IT Cybersecurity and AMS-IX. Did you like what you heard?

Do you want to learn more? Follow Thread Talks to stay up to date on the topic of cybersecurity.