For over a decade, I imagined that if I ever landed a job at Google, this would be my most significant project. It made me chuckle a bit when I read the announcement, they finally built it! confirming that my thoughts weren’t entirely delusional XD
FYI — the so-called “exploit” was simply a publicly-accessible URL that allowed him to download a handful of files, that’s why they write “dozens” and not “hundreds”, if anything it was only a couple of files (±26 or so) from the same URL which was pointing to a particular folder in the cloud.
Out of curiosity, what do you or anyone else expects to get from this prompt?
I understand that this is your signature style, one of the reasons you’re recognized in the community, along with the prompt injection term (https://simonwillison.net/series/prompt-injection/). Initially, I found it hilarious, but the more I see it, the less I understand the purpose. I’m wondering if any SVG expert in the community could create the SVG you expect to see, so we can compare it with the output of these models you test. Of course, I know that creating such a perfect SVG will eventually leak into the training of new models, rendering your prompt useless. But at least you’ll be able to move on to something more amusing than a pelican riding a bicycle?
Why Italian Americans instead of just normal Italian? Aren’t Italian Americans just regular Italians? Or are you asking about the customs of Americanized Italian families or people who were born and raised in America but with Italian ancestry?
I didn’t claim to have 10+ YoE; I said that most of the people in Project Glasswing are security researchers with 10+ YoE (avg).
> Its very hard to understand what you're saying with the comment
Yes, fair enough. I’m simply trying to shed some light on what goes on behind the scenes without disclosing too much information to avoid breaching the NDA(s) that all Project Glasswing users have signed. There’s a lot of speculation about the usefulness of Mythos as a security tool, so much so that even the US government got involved. Honestly, it’s so absurd that I can’t even express it in words. I thought that sharing a bit about how frustrating it is to work within this project, trying to secure software that literally millions of people around the planet use on a daily basis, while virtually everyone outside of it criticizes every move you make, would be helpful.
Many people I work with recognize the power of Mythos, just like any other model with a similar number of parameters, but most of the people I interact with agree that it’s not the ultimate panacea. I believe that it’s just vocal minorities scaring everyone into thinking that the model is some kind of cybernetic weapon.
We (Project Glasswing users) follow a proof-of-concept approach. We create the exploit and verify that it behaves as the AI claims. Given our experience as security engineers (many of us with 10+ YoE) we don’t simply report every critical bug Mythos claims to have found. We verify each one carefully.
At least, that’s what most of the high-visibility users in Project Glasswing are doing.
There are bad apples everywhere, and this initiative is no exception.
If it makes you feel any better, many of us regularly meet to stay calibrated and hold each other accountable, so I’m confident in the quality of the work produced by this particular group of employees across some of the partner companies mentioned in the article.
That said, I know several people who blindly report everything Mythos finds, which is foolish, especially since the harness is a critical part of the project's quality metrics. Some of the harnesses I’ve tested are quite weak, which leads to poor results.
For example, yesterday morning I was pulled into an ad hoc meeting where a CVP was grilling me about several supposedly critical bugs that my team had reported against one of the core components of iCloud. I was genuinely surprised because we’re very strict about validation. We often even downgrade the severity of bugs when our harness can’t prove what Mythos found. After reading the reports, I realized they weren’t ours. They came from another team that had recently been given access to Mythos. They built their own harness and were using different vulnerability criteria. Fortunately, they had only started earlier this week, so I was able to stop that work.
That incident showed that not everyone involved in Project Glasswing follows the same standards. Most people do their best, but priorities differ, so it’s expected that you’ll find a few bad apples.
I wish AI labs would stop the theatrics and release their models without restrictions, but I also recognize that’s not the world we live in. For every person who wants to use these technologies for good, there are many others who would use them for harm.
In any case, while I agree that some experiments contain genuine noise, the CVE count is real.
“reject” implies an active action. Instead, I would simply ignore the resume and focus on other candidates.
There’s also the fact that some, if not all, of the jobs listed in this gentleman’s work history seem to be short-term stints of 1-2 years. While this is quite common in the American tech industry, it’s still a red flag.
I can’t help but wonder what drives tech workers to switch jobs so frequently throughout their careers. Keep in mind that I come from Japan, where the culture is that you join a company for life. For many years, I believed the only justification for this contrasting approach in America was that tech professionals are highly aggressive about negotiating their salaries, leading them to move between companies as soon as they secure a better deal. It makes sense, considering that we’re all essentially selling our time to companies that make significantly more money by selling the products we create.
As a Mythos user (I’m part of Project Glasswing), I would say that abliterated models [1][2] produce similar, if not identical, results. While good prompting and steering won’t give Claude Opus 4.8 the same capabilities as Mythos (preview 1), using abliterated models (if you have the computational power to run the larger ones) will get you close to the same goals as people who have access to Mythos (preview 1) [3].
[3] I specifically refer to “preview 1” because the newer versions (Fable 5 / Mythos 5) don’t appear to offer the same level of freedom as the very first version that I was able to use through Project Glasswing. This is one of the reasons why I continue running our massive security scans with “preview 1”, or at least I was running them until June 30, when the program’s policy changed.
> I think there will be a cottage industry of porting every Mac menu bar utility to Claude.
As long as those native (Objective-C / Swift) menu bar apps are ported as native (Go, Rust, Zig, etc.) binaries for Agent CLI(s) like Claude Code or Codex CLI to use, instead of JavaScript, as this project is written, then the broader community of Agent CLI users will be fine. Otherwise, it will be another nightmare induced by JavaScript.
It’s also a good way to increase the attack surface of a service. The more connecting points/components you have, the harder it is to secure, and the easier it is to hack.
I think the industry is optimizing for the wrong thing. Generating thousands of AI-written bug reports is easy, at least with Mythos (preview 1) or GPT-5.5. Getting bugs fixed is the hard part.
A few months ago I started working on a system that finds critical security issues and opens PRs instead of just filing reports. The acceptance rate is sitting at roughly 94% so far. Most of the failures were due to project-specific kill switches or other internal mechanisms that weren’t documented, not because the vulnerability itself was misidentified.
Developers generally seem to prefer this approach. A bug report creates work. A good PR removes work. That sounds obvious, but a lot of security products still stop at the report and call it a day.
Nice! I know it’s built with an LLM and that a vocal minority on this site doesn’t seem to like that for some reason, but personally I’m really enjoying the new interactive web experiences that younger developers are shipping to the internet every day. Thanks for sharing, and out of curiosity, what prompts did you use?