This is a special post for quick takes by tchauvin. Only they can create top-level comments. Comments here also appear on the Quick Takes page and All Posts page.
The vulnpocalypse is here. Where are the large-scale cyberattacks?
Hopefully after the recent OpenAI news, the fact that large-scale attacks are coming is clear to all. Anyway, it's still interesting to explain the lag:
Vulnerabilities are just one small input to attacks. Especially small on mundane targets (as opposed to nation-state targets).
Even if this input (vulnerability discovery) is infinitely faster, cyberattacks will only increase by a capped amount (this is Amdahl's law).
The most effective cyberattacks are the ones with a human driving the intrusion hands on keyboard. Once that is unblocked (basically once malware becomes synonymous with LLM agent making API calls to "Together AI for cybercrime" serving open-weight models), we will see the large scale attacks. Did you know that your laptop is more valuable than just joining a botnet or mining crypto if someone can look at all of your files and threaten you to send the files to the public/the appropriate persons, unless you pay the ransom (itself set according to your standard of living)?
The same question was asked here in March 2025 but for SWE, and the top answers said the same thing (basically in the absence of end-to-end automation, Amdahl's law results in disappointing real uplift). A year later, we absolutely do have the 10x developers.
(Btw Gustafson's law seems more real than Amdahl's law but that's a detail here.)
On misleading figures in Daybreak and Glasswing:
OpenAI commits $1B of "subsidized access", i.e. commits essentially nothing (10% off on $10B of API purchases is $1B of subsidized access).
I'd say this is more disingenuous than Anthropic "committing up to $100M" in usage credits of Mythos, at a 5x Opus price that no one ever paid, as far as the public record goes (the price dropped to 2x Opus before Fable release).
(To be clear, these initiatives are great and I support them).
It's not well-specified and it does leave the door open for misuse, but I don't think it's misleading or disingenuous. I'm guessing the terms will end up being reasonable with heavy subsidization or free tokens.
For Anthropic's Mythos Preview access it's likely (IMO) that Mythos is a smaller distilled version of Mythos Preview that actually is cheaper to run.
Only circumstantial, and I think it's possible that Mythos is the same size as Mythos Preview.
I had previously considered the price drop the strongest evidence, but that doesn't distinguish between the two hypotheses. I personally consider it more likely than not due to Anthropic's compute limitations but that's speculative.
In the spirit of gwern's Writing for LLMs so They Listen, I've mirrored all my X posts on my website. Source code, what it looks like. In addition to LLM discoverability, I've found that looking back over my posts helps me develop my thinking.
When should a frontier-in-cybersecurity model be released to everyone?
Assuming that open-weight models are 6 months behind, I believe that access should be gradually expanded (defenders first, but with an increasingly loose definition) over the course of 6 months.
I think companies should publish the number of orgs and people on the "trusted access" list so we can check we are on track.
I suspect that the current rollout is too slow, and I'm afraid that the June 2 EO, and lack of cyber literacy that resulted in Fable 5 being suspended, will make this way worse.