by taspeotis
15 subcomments
- I don't know what the solution to this is, but I find it somewhat unfair that I pay money to Anthropic, and I pay money to OpenAI, and neither of them will let me use their best models for securing the software I work on.
Admittedly Opus 4.8 xhigh does a good job, but are my customers not entitled to have more security from a Fable/Mythos or GPT-5.5-Cyber audit over the codebase? Or I guess the inverse question: why aren't they allowed that audit?
(Fable/Mythos being unavailable notwithstanding.)
It seems OpenAI will at least let me do this narrowly, at greater cost, by using one of their partners. But I already pay them money!
by theplumber
3 subcomments
- Ok so why I don’t have access to this if I already pay for the max plan? Should I pay a security researcher to run codex on my code? Is this how it is supposed to work? Let’s hope we get some real cyber models that people can actually use from the Chinese without the stupid application forms.
- I read this news as white noise because there is no scenario in which I will be allowed access to this model. First, I happen to be a citizen of a country that is not the USA. What's more shocking is that I'm not even located in the US. Thus in the eyes of OpenAI I do not exist in regard to SOTA security models. Second, I will never ever do KYC with a company that provides text transformation services*. Third, even if I did, I will not be able to pass KYC because the typical KYC requirements are strictly tailored to a certain subset of the world's population and lifestyle choices, tuned by Americans according to their world view. Fourth, even if I pass KYC, my account will be banned by OpenAI immediately on the first prompt because they have close to 1B users and couldn't care less about any single one of them.
(*) which are nothing short of amazing and are changing the world, there's no doubt about that.
by jasonvorhe
1 subcomments
- "trusted defenders" sounds really Orwellian. Reminds me of EU's "trusted flaggers": https://digital-strategy.ec.europa.eu/en/policies/trusted-fl...
I don't trust any of these people. Meanwhile I'm paying ChatGPT and Claude and can't use their top-tier levels because they assume I'm some security risk/terrorist.
Local AI is our only hope.
by Recursing
1 subcomments
- I see a lot of knee-jerk comments to this, but I highly recommend running a scan ( https://openai.com/daybreak/codex-security-plugin/#codex-cli ) in your projects so you can evaluate it yourself. It found a real security issue in a project of mine, with very few false-positives.
Its built-in resume mechanism didn't work after it crashed when running out of my 5 hour session limit, but Claude Code was easily able to resume it 5 hours later reading the session logs and https://openai.com/codex/security/scan.sh
by mentalgear
14 subcomments
- No one commenting on the fact that oAI is releasing a Claude Mythos-class model - with apparent 0 restrictions or concerns by the US government, while Anthropic's (their competitor) model has been pulled weeks prior by the administration for 'security' reasons.
It certainly has nothing to do with openAI's co-founders donating to the current administrations election fund, are actively supporting the DoW war efforts of autonomous weapons and also otherwise being ideology tightly coupled with the current US government.
- Is it only my feeling, that the US government rolled back the Fable release, because they wanted their guy to get to the market before Anthropic?
- Would love to see the benchmark comparison between Mythos / Fable and GPT-5.5-Cyber
- Realistically, what can these types of commitments look like for the AI frontier companies, moving forward?
They're releasing ever more powerful models with stronger offensive capabilities. So do they have to help bolster the defense of all existing software, just... forever?
If we advance both the offence and defense with each new release, is this sustainable?
- Does the EU CRA now mean that every European company that either sells software or sells anything that has a software component is now forced to pay for this by September and update their software?
- It's a pretty interesting opportunity. I wonder if they will reach to companies and tell them how many things they could fix and how many are critical, before selling them the solution.
- This is how you do it when you're not AS childish. You go "here's a model for cybersecurity" and put a price on it. I know they're releasing it to some vendors first, etc. but the lack of a clown spectacle is nice.
The whole "it's too dangerous to release!" is complete hogwash.
A person can take a hammer, walk out in the street, and we can count how many people he can kill with the hammer before he is stopped. My local hardware store still sells hammers, and I haven't seen the CEO of it claim that their hammers are much more dangerous and it's totally going to end the world if you allow any random person to have one!
- Since this is more powerful than Fable in some of the benchmarks, surely it'll also get export controls... right? Right?
- ran the security 'plugin' on small app, in 15 min it eat up all of my quota - so it did exactly what I was expecting it to do
- Security is a great business model. You sell locks, and if thieves break in, you sell more and stronger locks. There are no consequences for the lock-maker. Similarly, AI tools can both find and fix vulnerabilities. Not only that, AI can create vulnerabilities in the code it generates. Now that is a perpetual money machine.
- I guess eventually the whole process can be completely autonomous, what could possibly go wrong :-)
by arikrahman
0 subcomment
- It's good looking forward to wrapping it around Reasonix
by lisa_luoyf
0 subcomment
- Interesting release. I’m most curious about how well this holds up in messy real-world environments, since that’s usually where specialized benchmark gains get tested.
- AI companies yearn for otgs built on AI tools
- I think if nothing happens from the government, then this would be a very good example of the benefit of keeping your mouse shut especially if you are lying to get some hype like Anthropic did for months.
by throwaway888abc
1 subcomments
- Can someone on HN with access to it fix the Fable / Mythos so it's secure to use again and therefore available ?
by theodorespeak
0 subcomment
- Let's see if I can connect the dots as well as I think I can.
Just putting it here for posterity.
Like those movies before them, The Creator will be a cult classic in a few years.
The acting was okay, the story was okay.The vfx were great.
The premise is prophetic.
America and China will go to war over AI.
America will try and contain it for themselves. China will keep on trying to keep it accessible.
After endless negotiations between the two superpowers, there is no more room left for talking.
The free (not as in beer) AI models were always seemingly slightly worse than the proprietary American models. A barely noticeable difference on most tasks, but a difference nonetheless.
The breakthrough came when people, companies and governments began chaining and pooling models and infrastructure together,because they were free to do so, thereby creating behemoths that America could not outclass, outsmart or outspend.
And when you stake your whole future on that one thing, it's winner take all.
So for that reason they all had had to die.
And so the war began...
- Chinese and Russian intel agencies can set up American shell corporations and buy all of our personal data....but using a model to secure my customer? Well...no...you can't have that.
- whats the point of a benchmark if its not deployable? another glasswing pr stunt to me
by brcmthrowaway
0 subcomment
- Gamechanger
by beyondscaletech
0 subcomment
- [flagged]
Hacker News