130 comments • Comments Link

这篇博客被批评为含糊、像由 AI 生成的广告，基本只是重复了 Mythos 的发布公告，却没有给出具体数据，难以将新模型与先前版本进行比较。

对于所谓"阶跃函数"改进的说法，部分人怀疑其成功归因于大量计算资源的持续投入，而不是一个根本不同的基础模型。

评论者还指出一个日益明显的趋势：企业博客越来越由 LLM 撰写，导致独特声音丧失，充斥着空洞术语和平淡的企业语气。

讨论中有人担忧出现"模型崩溃"或反馈循环：AI 生成的内容被回收进训练数据，可能扼杀人类创造力和表达多样性。

尽管 Mythos 因能把低严重性漏洞串联成复杂利用链而获得赞扬，批评者指出它仍然高度依赖人类专业知识来验证发现，以避免误报或幻觉问题。

文中所谓的"经验教训"被认为不够新颖，但对抗性审查被视为改进 AI 工作流的有价值手段。

安全专家强调，虽然 AI 降低了发现漏洞的成本，但解决之道不是更多 AI，而是编写安全的代码并采用内存安全的语言，以减少不可避免的人为错误。

有人引用 cURL 维护者对 Mythos 的评估作为证据，认为该模型在经过良好审计的代码库上可能表现令人失望，尽管它仍对大量"糟糕"或不安全的代码构成重大威胁。

缺乏关于漏洞严重性和误报率的数据，进一步加深了对该工具实际效用的怀疑。

讨论还提到 Anthropic——一家专注于 AI 安全的公司，可能也在用 AI 做营销，其产品如 Claude Code 仍存在重大缺陷。

总体而言，话题反映出对企业 AI 公告的深刻怀疑，尤其是在缺乏可验证证据或明显以营销为导向的情况下。社区虽承认 AI 在攻防能力上带来了重大变化，但仍强调人类专业知识在验证和基本编码实践方面不可替代的作用。该线程还暴露了由于 LLM 在专业交流中广泛采用而导致的写作风格同质化和由此产生的文化疲劳。 • The blog post is criticized for being a vague, AI-generated advertisement that rehashes the Mythos announcement without providing concrete data, making it difficult to compare the new model to predecessors.

• There is skepticism regarding the "step function" improvement claims, with some attributing the model's success to compute-intensive, always-on operation rather than a fundamentally different base model.

• Commenters highlight a growing trend of corporate blogs being written by LLMs, leading to a loss of distinct voice and an increase in "load-bearing" terminology and bland corporate style.

• The discussion raises concerns about "model collapse" or a feedback loop where AI-generated content becomes training data, potentially stifling human creativity and diversity of expression.

• While Mythos is praised for its ability to chain low-severity bugs into complex exploits, critics note that it still requires significant human expertise to verify findings and avoid false positives or hallucinated issues.

• The post's "lessons learned" are viewed as obvious, though the concept of adversarial review is noted as a valuable takeaway for improving AI workflows in various fields.

• Security professionals emphasize that while AI lowers the cost of finding vulnerabilities, the solution is not more AI, but rather writing secure code and using memory-safe languages to mitigate inevitable human error.

• The cURL maintainer's evaluation of Mythos is cited as evidence that the model may be underwhelming against well-audited codebases, though it remains a significant threat to the vast amount of "shitty" or insecure code in the wild.

• There is frustration over the lack of transparency and hard numbers regarding the severity of vulnerabilities found and the ratio of false positives, which fuels skepticism about the tool's actual efficacy.

• The conversation touches on the irony of Anthropic, a company focused on AI safety, potentially using AI for their own marketing while their products like Claude Code still exhibit significant bugs.

The discussion reflects a deep-seated skepticism toward corporate AI announcements, particularly when they lack empirical evidence or appear to be marketing-driven. While there is an acknowledgment that AI represents a significant shift in offensive security capabilities, the community stresses the irreplaceable role of human expertise in verification and the necessity of fundamental secure coding practices. The thread also reveals a cultural fatigue with the homogenization of writing styles caused by the widespread adoption of LLMs in professional communication.