An initiative to secure the world's software | Project Glasswing

0:00 Most people who use software every day don't think about bugs.

0:04 They don't think about what can happen if

0:07 the software that they depend upon suddenly is less secure.

0:12 That's something that software developers have to deal with every single day.

0:19 Software has always had flaws and vulnerabilities.

0:22 That's not new.

0:23 For an average person, the bugs are, by and large,

0:28 not something they notice on a daily basis, because if they do, they get fixed.

0:32 But then every so often,

0:33 there are vulnerabilities that have real severe impacts.

0:36 Like one single bug that works its way into shared software that many,

0:42 many, many different products or websites use.

0:45 One issue just gets magnified out around the world.

0:48 Historically, finding and patching vulnerabilities has been a slow,

0:53 time-consuming, and expensive process.

0:55 If LLMs are now able to write code,

0:58 at the level of some of the greatest software developers in the world,

1:04 it can also be used to find bugs and exploit that software equally effectively.

1:10 These models have capabilities which are

1:12 raising the bar from a cybersecurity point of view with their ability to help

1:19 defenders as well as potentially help adversaries.

1:23 We recently developed a new model, Claude Mythos Preview.

1:27 Early on, it was clear to us that this model

1:30 was going to be meaningfully better at cybersecurity capabilities.

1:33 There's a high accelerating exponential,

1:36 but along that exponential, there are points of significance.

1:40 Claude Mythos Preview is a particularly big jump along that point.

1:45 We haven't trained it specifically to be good at cyber.

1:48 We trained it to be good at code,

1:50 but as a side effect of being good at code, it's also good at cyber.

1:53 The model that we're experimenting with is by and large

1:57 as good as a professional human at identifying bugs.

2:03 It's good for us because we can find

2:04 more vulnerabilities sooner and we can fix them.

2:07 It has the ability to chain together vulnerabilities.

2:10 What this means is you find two vulnerabilities,

2:12 either of which doesn't really get you very much independently,

2:16 but this model is able to create exploits out of three, four,

2:19 sometimes five vulnerabilities that in sequence

2:22 give you some very sophisticated end outcome.

2:24 And we think that this model can do this really

2:27 well because we noticed that this model is very autonomous.

2:30 It's just generally better at pursuing really

2:34 long-range tasks that are kind of like

2:36 the tasks that a human security researcher would

2:39 do throughout the course of an entire day.

2:41 Obviously, capabilities in a model like this could

2:44 do harm if in the wrong hands, and so we won't be releasing this model widely.

2:49 More powerful models are going to come from us and from others,

2:53 and so we do need a plan to respond to this.

2:56 That's why we're launching what we're calling Project Glasswing,

2:59 where we partner with a number of the organizations that power

3:02 some of the world's most critical code to put the model

3:06 into their hands to allow them to look at how they

3:09 can use models like this to bring down risk and protect everyone.

3:12 And by giving these software developers advanced tools before anyone else,

3:19 it gives all of us a collective headstart.

3:22 It allows us to find things that we couldn't find before,

3:25 and it helps us fix these things much more quickly.

3:30 Working with our partners,

3:31 we've been finding vulnerabilities across essentially every major platform.

3:36 I found more bugs in the last couple of weeks

3:38 than I found in the rest of my life combined.

3:41 We used the model to scan a bunch of open-source code and the thing that we

3:46 went for first was operating systems because this is

3:49 the code that underlies the entire internet infrastructure.

3:52 For OpenBSD, we found a bug that's been present for 27 years,

3:57 where I can send a couple of pieces of data to any OpenBSD server and crash it.

4:05 On Linux, we found a number of vulnerabilities where,

4:08 as a user with no permissions, I can elevate myself to the administrator

4:13 by just running some binary on my machine.

4:15 For each of these bugs,

4:17 we told the maintainers who actually run the software about them,

4:20 and they went and fixed them and have deployed the patches so

4:23 that anyone who runs this software is no longer vulnerable to these attacks.

4:27 For a developer who tirelessly maintains software,

4:30 a model that can help them discover vulnerabilities in their own

4:34 code and fix them before they can be exploited, that is an invaluable tool.

4:40 We've spoken to officials across the US government,

4:43 and we've offered to work with them and collaborate to assess the risks

4:47 of these models and to help defend against the risks of these models.

4:50 Everything that we do in our lives now depends on software.

4:54 Software ate the world.

4:56 Every analog aspect of our life is somehow represented in the digital domain.

5:02 And so all of our daily lives run on the idea

5:05 that we can rely on the systems that power them.

5:08 Cybersecurity is the security of our society.

5:11 It is essential that we come together and work

5:14 together across industry to help build better defensive capabilities.

5:18 No single organization sees the whole picture and can tackle this on their own.

5:22 This is not going to be done as part of a few week program.

5:25 This is going to be the work of certainly months, perhaps years.

5:29 But what I do hope is at the end

5:31 of this, we can be in a position where the world's software,

5:35 its customer data, its financial transactions,

5:38 its critical infrastructure are safer than they were before.