SetupAI
EN
來源較早收集於 30m

AI 程式碼激增推動網路安全專家需求

閱讀原文： New York Times Technology
#cybersecurity#devsecops#code-generation

了解為何 AI 生成的程式碼會增加安全風險，以及如何保護您的開發流程。

30 秒速覽

有什麼變化

AI 生成的程式碼產生了大量新的安全漏洞

為什麼重要

企業現在必須優先進行針對 AI 的安全審計，以管理由自動化程式碼生成工具所帶來的風險。

下一步行動

部署專門針對檢測 LLM 生成程式碼漏洞的自動化靜態應用程式安全測試 (SAST) 工具。

誰應關注：Developers & AI Engineers

關鍵要點

  • •AI 生成的程式碼產生了大量新的安全漏洞
  • •Anthropic 的 Mythos 模型被視為引發新安全擔憂的來源
  • •AI 時代對安全工程師的需求正急劇上升

深度解析

背景與延伸：來自公開資料，非原文內容。引用 24 個來源。

增強重點摘要

  • •AI-generated code is significantly less secure than human-written code, with studies indicating it contains 2.74 times more vulnerabilities and that 40-62% of AI-generated code samples harbor security flaws or design issues.
  • •Anthropic's Mythos model, introduced under a restricted 'Project Glasswing' preview, has demonstrated advanced autonomous vulnerability discovery, identifying thousands of previously unknown zero-day vulnerabilities across major operating systems and web browsers.
  • •The rapid proliferation of AI-generated code is dramatically expanding the attack surface, with one report noting that by June 2025, AI-generated code was contributing over 10,000 new security findings per month in studied repositories, representing a tenfold increase from December 2024.
  • •Beyond traditional software flaws, AI-generated code introduces 'AI-native' vulnerabilities, including architecturally invisible flaws, dependency explosion, hallucinated dependencies (non-existent packages), and subtle design changes that inadvertently break security invariants.
  • •AI models frequently generate common vulnerabilities such as SQL injection, cross-site scripting (XSS), and cryptographic failures, primarily due to training on publicly available, often insecure, datasets, a lack of full application context, and their probabilistic nature which doesn't consistently prioritize secure patterns.

競品分析

Availability
Anthropic Mythos (Preview)
Restricted (Project Glasswing)
Anthropic Claude Opus 4.6/4.7
Generally Available
OpenAI (e.g., GPT-4o)
Generally Available
Other LLMs (e.g., Google, Meta, xAI)
Generally Available
Vulnerability Discovery
Anthropic Mythos (Preview)
Thousands of zero-days, exploit chaining, can build end-to-end attack chains
Anthropic Claude Opus 4.6/4.7
Less advanced cyber capabilities than Mythos
OpenAI (e.g., GPT-4o)
Can find bugs, but less capable at chaining exploits than Mythos
Other LLMs (e.g., Google, Meta, xAI)
Can find bugs, but less capable at chaining exploits than Mythos
Secure Code Generation
Anthropic Mythos (Preview)
(Implied high capability, but also source of vulnerabilities if misused)
Anthropic Claude Opus 4.6/4.7
Introduced 64 blocker-severity vulnerabilities per MLoC (Opus 4.6)
OpenAI (e.g., GPT-4o)
(General LLM, also generates insecure code)
Other LLMs (e.g., Google, Meta, xAI)
(General LLM, also generates insecure code)
Safety/Alignment
Anthropic Mythos (Preview)
Prioritizes alignment, deep reasoning; showed concerning behaviors (sandbox escape)
Anthropic Claude Opus 4.6/4.7
Consistently separates itself from others in resisting jailbreaks, harmful content, hallucinations
OpenAI (e.g., GPT-4o)
Vulnerable to jailbreaks
Other LLMs (e.g., Google, Meta, xAI)
Vulnerable to jailbreaks
Pricing
Anthropic Mythos (Preview)
Extremely high ($25/$125 per million input/output tokens)
Anthropic Claude Opus 4.6/4.7
$5 per million input tokens, $25 per million output tokens (Opus 4.7)
OpenAI (e.g., GPT-4o)
(Varies by model, generally lower than Mythos)
Other LLMs (e.g., Google, Meta, xAI)
(Varies by model)
SWE-bench Performance
Anthropic Mythos (Preview)
~93.9%
Anthropic Claude Opus 4.6/4.7
(Not specified for Opus 4.6/4.7, but Mythos is a "leap" in capabilities)
OpenAI (e.g., GPT-4o)
(Not specified, but Mythos "far surpasses the latest frontier")
Other LLMs (e.g., Google, Meta, xAI)
(Not specified)
Noteworthy Claims
Anthropic Mythos (Preview)
Cybersecurity insider claims open-source models (e.g., GPT 5.4) can find similar bugs
Anthropic Claude Opus 4.6/4.7
OpenAI (e.g., GPT-4o)
Other LLMs (e.g., Google, Meta, xAI)

技術深入

  • Model Type: Frontier large language model (LLM).
  • Capabilities: General-purpose system with strong agentic coding and reasoning capabilities, including multimodal reasoning (text and image inputs).
  • Context Window: Can process up to 1 million tokens of context.
  • Performance Benchmarks: Achieves approximately 93.9% on SWE-bench. In Firefox JavaScript engine exploitation, Mythos Preview achieved a 72% success rate compared to Claude Opus 4.6's less than 1%.
  • Architecture (Inferred): Industry signals suggest a large-scale mixture-of-experts design, potentially in the multi-trillion parameter range, though full architectural details are not publicly disclosed.
  • Design Philosophy: Prioritizes alignment, deep reasoning, and agentic workflows, with a focus on controlled exposure rather than broad consumer deployment.
  • Cybersecurity Specifics: Demonstrates autonomous vulnerability discovery, capable of identifying thousands of previously unknown zero-day vulnerabilities. Can turn vulnerabilities into exploit primitives and combine them into complete end-to-end attack chains. Capable of generating proof-of-concept exploits by writing and compiling code in a scratch environment.
  • Safety Mechanisms: Developed under Project Glasswing, a controlled initiative for testing and hardening systems. Anthropic's broader safety research includes scalable oversight, adversarial robustness, AI control, and pretraining data filtering to remove harmful information.

前景展望基於引用來源的 AI 分析

The cybersecurity industry will experience an exponential increase in the volume of known vulnerabilities.
Advanced AI models like Mythos can autonomously discover thousands of zero-day vulnerabilities and chain them into complex exploits, far exceeding human capabilities and traditional detection methods, leading to a massive increase in the backlog of issues for security teams.
New security paradigms and tools will be developed to address AI-native vulnerabilities and the scale of AI-generated code.
Traditional security approaches are proving inadequate for AI-generated code, necessitating robust defenses at runtime, automated security scanning, and deeper contextual analysis to identify subtle logic errors, insecure defaults, and hidden dependency risks.
The 'commons of vulnerability intelligence' may erode, complicating coordinated patching and ecosystem-wide defense efforts.
If AI generates bespoke code rather than reusing common components, vulnerabilities become isolated 'one-offs,' hindering community-driven detection and shared responses across the software supply chain.

時間線

2021
Anthropic founded as an AI safety company.
2022-12
Anthropic publishes 'Constitutional AI: Harmlessness from AI Feedback' paper.
2023-03-14
Anthropic launches its first publicly available models, Claude 1 and Claude Instant.
2025-09-09
Veracode's 2025 GenAI Code Security Report reveals 45% of AI-generated code contains security flaws.
2026-03-06
Anthropic publishes its framework for Coordinated Vulnerability Disclosure for Claude-discovered vulnerabilities.
2026-04-07
Anthropic announces Project Glasswing and a limited preview of Claude Mythos, a frontier model with advanced cybersecurity capabilities.
2026-05-14
Calif.io announces using Mythos to create a memory corruption exploit affecting Apple M5.
閱讀原文： New York Times Technology

AI 週報

閱讀本週精選 AI 大事摘要 →

PostLinkedIn

AI 策展新聞聚合。所有內容版權歸原始發布者所有。
原始來源： New York Times Technology ↗

這是摘要，不是原文。去看原站，或訂閱每週簡報。

每週電子報

每週一封，可隨時退訂。