Playing with AI workflows to do vulnerability research

[Xavi.Garcia]

Hi excellent people,

A few weeks ago, when the Mythos hype started, Risky Business discussed how important are workflows and harnesses to find software vulnerabilities. Even with inferior models. See the links below.

I had this in the backlog for a while, but I started playing with IronCurtain this week. I’ve been struggling a lot because I refuse to pay for AI due to personal believes, but I managed to point IronCurtain to a self-hosted open-weight LLM using a LiteLLM proxy. Yes, that Python package that was hacked the other week

So far, I tried with one of our public code bases and it looks promising, but I still have to verify the output. After thinkering for a week, I thought it was worth sharing my experience.

My plan is to learn what is behind the Mythos hype, and report back to our community in the research and academia.

• Mythos smythos! How to find 0day with lesser models - Risky Business Media
• GitHub - provos/ironcurtain: A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev) · GitHub

[hgb]

I understand AI skepticism and hesitancy deep in my core, but the work S1 threat research on Fast16 is pretty clear evidence of the power of the tools (https://www.sentinelone.com/labs/fast16-mystery-shadowbrokers-reference-reveals-high-precision-software-sabotage-5-years-before-stuxnet/) in doing software writing and analysis at levels that humans struggle with.