Project Glasswing — 코드에 능한 모델은 사이버에도 능하다

생각 덩어리

공유된 코드 한 개의 버그 — 세계로 증폭되는 취약점

Like one single bug that works its way into shared software that many, many, many different products or websites use. One issue just gets magnified out around the world.

Historically, finding and patching vulnerabilities has been a slow, time-consuming, and expensive process.

코드를 잘하면 사이버도 잘한다 — 부작용으로서의 역량

If LLMs are now able to write code, at the level of some of the greatest software developers in the world, it can also be used to find bugs and exploit that software equally effectively.

These models have capabilities which are raising the bar from a cybersecurity point of view with their ability to help defenders as well as potentially help adversaries.

We haven't trained it specifically to be good at cyber. We trained it to be good at code, but as a side effect of being good at code, it's also good at cyber.

취약점을 엮는다 — 사람 수준의 발견과 자율성

The model that we're experimenting with is by and large as good as a professional human at identifying bugs.

you find two vulnerabilities, either of which doesn't really get you very much independently, but this model is able to create exploits out of three, four, sometimes five vulnerabilities that in sequence give you some very sophisticated end outcome.

It's just generally better at pursuing really long-range tasks that are kind of like the tasks that a human security researcher would do throughout the course of an entire day.

널리 풀지 않는다 — 잘못된 손에 들어가면

Obviously, capabilities in a model like this could do harm if in the wrong hands, and so we won't be releasing this model widely.

More powerful models are going to come from us and from others, and so we do need a plan to respond to this.

Project Glasswing — 가장 중요한 코드를 지키는 이들에게 먼저

That's why we're launching what we're calling Project Glasswing, where we partner with a number of the organizations that power some of the world's most critical code to put the model into their hands to allow them to look at how they can use models like this to bring down risk and protect everyone.

And by giving these software developers advanced tools before anyone else, it gives all of us a collective headstart.

27년 묵은 OpenBSD 버그 — 운영체제부터 훑다

I found more bugs in the last couple of weeks than I found in the rest of my life combined.

For OpenBSD, we found a bug that's been present for 27 years, where I can send a couple of pieces of data to any OpenBSD server and crash it.

On Linux, we found a number of vulnerabilities where, as a user with no permissions, I can elevate myself to the administrator by just running some binary on my machine.

소프트웨어가 세상을 먹었다 — 사회의 보안은 함께

Software ate the world.

Cybersecurity is the security of our society. It is essential that we come together and work together across industry to help build better defensive capabilities. No single organization sees the whole picture and can tackle this on their own.

we can be in a position where the world's software, its customer data, its financial transactions, its critical infrastructure are safer than they were before.