Anthropic 的 Mythos 发现了数百万个安全漏洞

欢迎收听本播客。

Welcome to the podcast.

我是主持人贾登·沙弗。

I'm your host, Jaden Shafer.

今天节目中，我们要讨论Anthropic公司的Project Glasswing。

Today on the show, we are talking about Project Glasswing from Anthropic.

他们就是一个小时前刚刚发了这条推文。

They just tweeted this out, like, an hour ago.

他们说：推出Project Glasswing，一项紧急计划，旨在帮助保护全球最关键的软件。

They said, introducing Project Glasswing, an urgent initiative to help secure the world's most critical software.

该项目由我们最新的前沿模型Claude Mythos Preview驱动，其发现软件漏洞的能力优于除最顶尖人类之外的所有人。

It's powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.

好的。

Okay.

有个疯狂的项目。

There is this crazy project.

它还没有向公众开放。

It's not released to the public.

他们正在将这个项目提供给安全研究人员，并承诺提供一亿美元，主要面向微软等大型公司，让他们测试所有开源软件和全球范围内的软件，找出漏洞并提前修复，因为他们表示，这将对代码构成生存危机，因为一切都有可能被黑客攻击，到处都存在可被发现的漏洞。

They're sending this out to security researchers, and they've pledged a $100,000,000, essentially to big companies like Microsoft to go and test all of the open source software, all of the software in the world, to find the vulnerabilities and fix it before they release this to the public because they said, basically, this is going to be an existential crisis for code because everything can be hacked and there's vulnerabilities everywhere that can be found.

所以他们想先让安全研究人员把所有问题都修复好，再正式发布。

So they're trying to, like, give it to the security researchers to fix everything before they release it.

而且这不仅仅针对软件。

And it's not just for software.

这是一个普遍极其强大的模型，但这只是他们关注的一个方面。

This is just a general insanely good model, but that's just something that they're concerned about.

所以我们在播客中会深入探讨这一切，但不会太过悲观。

So we're gonna get into all of that on the podcast without too much doomerism.

我觉得其中有很多乐观的方面，但这确实是一个极其重大的模型突破。

I think there's a lot of optimism, but is this is definitely a absolutely massive drop in model.

说到AI模型，如果你想测试所有顶尖的AI模型，从Anthropic、OpenAI、Grok、Gemini到Eleven Labs的音频模型，以及众多出色的图像模型，欢迎访问我的初创公司aibox.ai，每月仅需8.99美元。

And speaking of AI models, if you wanna test all of the top AI models, everything from Anthropic to OpenAI to Grok to Gemini to eleven Labs for audio, tons of cool image models, go check out my startup aibox.ai for $8.99 a month.

你可以访问超过80个顶级的音频、图像、文本和视频模型。

You get access to over 80 of the top audio, image, text, video models.

OpenAI的模型现在很昂贵，因为生成一个视频要花130美元，但对你来说却非常便宜。

OpenAI is sore, which is gonna get discontinued because it costs a $130 to generate a video for them, but for you, it's very cheap.

所以如果你想了解，就去看看aibox.ai吧。

So if you wanna check it out, go check out aibox.ai.

希望这能帮你省下一大笔钱，所有功能都能在一个地方访问。

Hope that saves you a ton of money, you get access to everything in one spot.

好的。

Alright.

我们来聊聊Anthropic最近的情况。

Let's talk about what's going on with Anthropic.

他们刚刚发布了他们所谓的迄今为止最强大的模型。

So they just released this, what they're calling, of course, their, quote, most powerful model yet.

有趣的是，通常每个人都会说，这是他们最有能力的模型。

Now what's interesting is usually everyone's like, this is our, you know, most capable model.

这是最强大的。

This is most powerful.

这听起来有点令人不安。

This it sounds a little bit, ominous.

有一份泄露的备忘录，他们实际上就是这么称呼它的。

There was a leaked memo, where they were actually calling it that.

所以这是他们告诉外界的说法。

So this is what they told the world.

这只是内部的一种说法。

This is just kind of internally.

目前，这仅限于为一批顶尖机构作为一项新安全倡议的首发，该倡议有40家合作伙伴组织，它们正在多个所谓的国防安全领域部署该模型。

And, basically, this right now is limited to it's just kind of a debut for a bunch of the top organizations as part of a new security initiative, in which there's 40 partner organizations, and they're all deploying the model across a bunch of different, quote unquote, defense security work areas.

他们基本上是在试图在该模型向公众开放之前，确保关键软件的安全。

And they're basically trying to secure critical software before this goes out to the general public.

我认为他们没有明确说明这是基于什么训练的，所以他们并没有说，嘿。

I think they didn't specify exactly what this was trained on, so they're not saying like, hey.

我们专门针对网络安全工作或源代码进行了训练。

We specifically trained this on, like, cybersecurity work or or kind of, like, source code.

但目前他们向所有人提供的预览版正在用于扫描第一方和开源软件系统。

But right now, the preview that they're sending out to everyone is being used to scan both first party and open source software systems.

他们正在寻找代码漏洞，并将此工具提供给许多大型组织。

They're looking for code vulnerabilities, and they're just giving this out to a lot of the big organizations.

他们现在表示，在过去几周里，他们内部使用该工具，成功发现了数千个零日漏洞，其中许多属于关键级别。

What they're saying right now is that over the last few weeks, they were using it internally, and they were able to identify, quote, thousands of zero day vulnerabilities, many of them critical.

因此他们说，许多漏洞其实已经存在了一二十年。

So they're saying a lot of the vulnerabilities are one to two decades old.

所以他们开发了这款新软件。

So they have this new software.

他们在代码库上运行它，发现了存在于几乎所有系统中长达十年到二十年的漏洞，这让他们非常担忧。

They ran on code bases, and they're finding vulnerabilities that have been around for ten to twenty years in literally everything, and they're just they're concerned.

他们真的不敢将此工具公开发布，因为他们觉得，一旦向公众发布，几乎所有软件的安全性都将面临崩溃。

They they really can't release this to the public because they're like, as soon as we release this to the public, security of basically all software is going to explode.

所以现在他们正试图在发布之前，让能够修复这些问题的人先使用它。

So now they're trying to get this out to people that can fix it before they release it.

这就像，这个模型太强大了，我们必须先修复世界上所有的软件，才能发布它。

It's like, the the model's so powerful, they can't release it till we fix all the software in the world.

于是他们说，好吧，各位。

And so they're like, okay, everyone.

我们真的很想发布这个新模型，因为它们可能会赚很多钱，超越OpenAI，但除了我们可能会摧毁整个互联网和所有软件之外，没有任何东西能阻止我们。

We really wanna release this new model because they're probably gonna make a lot of money and beat OpenAI, but, like, we're not held back by anything other than that we're gonna destroy the entire Internet and all software combined.

所以，老实说，这是一个相当疯狂的观点。

So, honestly, that's a pretty wild a pretty wild point.

而且，这简直太疯狂了。

And, I mean, this is just crazy.

显然，这不仅仅是一个软件模型。

Apparently, this isn't just like a a software model.

它是一个通用模型。

It's a general purpose model.

这是新的级别。

It's it's the new tier.

所以他们有Opus、Sonnet这些。

So they have, like, Opus, Sonnet.

他们还有其他级别。

They have these other tiers.

这个将是Mythos，属于下一个更高的级别。

This is gonna be Mythos, and it is kind of the the next highest tier.

他们还有一个更高的级别。

They have a higher tier.

我猜他们不再继续使用Opus模型或者Sonnet模型了，而Opus原本是最强的。

I guess they're not continuing with the opus model, or the, you know, sonnet model, but kind of the opus being the best.

他们实际上正在创造一个新东西，因为这是一个巨大的飞跃，这非常有趣。

They actually are creating a new thing because it is such a big step up, which is really interesting.

它具备非常强大的代理式编码能力和推理能力。

It has really strong agentic code need coding and reasoning skills.

所以所有使用Claude Cowork的人——我一直大力推荐这个产品——还有最近的Claude Code，都会非常喜欢它。

So everyone using Claude Cowork, which I've been shouting from the rooftops, and Claude Code recently are going to love it.

这基本上是最复杂、性能最强的模型。

And it's basically the most sophisticated and high performance model.

它能够处理复杂的任务，也能胜任大量的智能体构建和编程工作。

It can do complex tasks, and it can do a lot of agent building and coding.

那么，Anthropic会把这款模型提供给谁，让他们去测试全球各种代码库并修复所有漏洞呢？

So who is Anthropic giving this to in order to go and, you know, put it out onto all of the different, you know, test all the code bases in the world and fix all these vulnerabilities?

他们将把这款模型提供给亚马逊、苹果、博通、思科、CrowdStrike、Linux基金会、微软和Palo Alto Networks。

They're giving it to Amazon, Apple, Broadcom, Cisco, CrowdStrike, the Linux Foundation, Microsoft, and Palo Alto Networks.

所有这些公司都会分享他们使用该模型所获得的经验，以便整个科技界都能从中受益。

All of those people are going to share what they've learned from using the model so that the rest of the tech world can benefit from it.

这款模型不会公开发布，所以我们不知道它究竟什么时候会正式上线。

It's not gonna be made publicly available, so we don't know exactly when they're gonna actually launch it.

这感觉就像在观望，静待其变。

It feels it's kind of like a wait and see.

他们说，你看。

They're like, look.

我们正在把这提供给所有最大的科技公司。

We're giving this to all of the biggest tech companies.

我们会看看他们能用它做什么，能用它修复什么，能教给我们什么，然后我们再决定如何以及何时发布它。

We're gonna see what they can do with it, what they can fix with it, what they can teach us about it, and then we'll basically decide on how and when we get this out.

Anthropic表示，目前他们正在与一批联邦官员就Mythos的使用进行持续讨论。

Anthropic says that right now they have engaged in, quote, ongoing discussions with a bunch of federal officials about the use of Mythos.

尽管可以想象，我认为这些讨论很大程度上因Anthropic与当前政府之间的一系列法律纠纷而变得复杂。

Although one would imagine that I think a lot of those discussions are pretty complicated by the fact that Anthropic and the current administration are having a whole bunch of legal battles.

五角大楼将这家AI实验室列为供应链风险，因为Anthropic不允许他们使用其AI模型进行自主瞄准或监控，并且设定了许多规则，而他们不愿遵守。

Pentagon labeled the AI lab a supply chain risk because Anthropic didn't let them use their AI model for autonomous targeting or surveillance and basically had a bunch of different rules and they didn't wanna follow them.

或者也许他们只是不想树立有规则的先例，这可能是相当公正的评价。

Or maybe they just didn't want the precedent of having rules, think would probably be a fair characterization.

但无论如何，目前的这一消息最初是不久前被泄露的。

But in any case, news of this right now is originally something that got leaked a little while back.

我们对此有所报道。

We kind of reported on it.

《财富》杂志报道了一起数据安全事件，还有一篇未发布的博客草稿被人发现，其中提到了这件事。

There was a data security incident that got reported by Fortune, and there was a blog with some, you know, some it was like an unpublished blog draft somewhere that someone found, and it alluded to this.

所以我们早就知道这件事要来了。

So we kind of knew that this was coming.

但我们没料到事情会这么严重。

We didn't realize how wild this was.

基本上，Anthropic 将这次泄露归咎于人为错误。

Basically, Anthropic attributed that leak in particular to, quote unquote, human error.

所以他们说，你看。

So they're like, look.

这并不是 AI 模型泄露的。

It wasn't like an AI model leaking this.

AI 模型没干这事。

The ant model didn't do it.

但他们确实提到，Capybara 是新一代模型的新名称。

But what they did say is that Capybara is the new name for a new frontier of model.

它比 Opus 更大、更智能。

It's larger and more intelligent than Opus.

所以它真的会被命名为 Capybara。

So it's actually gonna be called Capybara.

我想，这是他们最新的命名，我不知道他们这些名字都是从哪儿想出来的。

That's, I guess, their their latest I don't know where they get the names for these.

在我看来，这几乎和 Bard 一样糟，但随它吧。

It's almost as bad as bard in my opinion, but whatever.

所以 Capybara 会比 Opus 更强大，而 Mythos 则是这些模型的总称。

So Capybara is gonna be better than Opus, but Mythos is kind of the umbrella of models.

对吧？

Right?

他们经常会推出一系列模型，搞一个总括性的分类，然后从最强的开始，接着是中等的，以便节省电力，再往下就是差一点的，适合在本地或边缘设备上运行之类的。

They kinda do these these pushes where they'll make an umbrella of models, and they go from best and then, like, medium if you wanna save power and then kinda worse if you wanna, like, run it on locally or on an edge device or something like that.

所以Capybara是新的那个。

So Capybar is the new one.

它将取代Opus。

It's it's gonna replace Opus.

根据所有这些泄露的文件，它被称作迄今为止我们开发过的最强大的AI模型。

And according to all these leaked documents, it is quote, by far the most powerful AI model we've ever developed.

在这份泄露资料中，Anthropic声称，这个新模型在软件编程、学术推理和网络安全等领域将远超现有性能。

In this leak, Anthropic claimed that this new model was going to far exceed the performance in areas like software coding, academic reasoning, and cybersecurity.

显然，网络安全是他们关注的重点领域之一，因为他们现在正大力推动这一方向。

And, evidently, the cybersecurity was one of the big areas they were concerned about because now they're pushing this you know, making this big push.

当它发布时，如果你看看当前一些公开的模型，我们当然可以用ChatGPT、Gemini或其他任何模型来应对某些网络安全问题，但这个模型显得如此先进。

When they released it, you know, if you kinda look at some of the current public models, we we like, sure, you could use something like ChatGPT or or Gemini or anything for some sort of cybersecurity issue, but it feels like this this one is so advanced.

他们担心这种技术会被不良行为者武器化。

They're concerned about the threats of this being weaponized by bad actors.

它会发现漏洞并加以利用。

It's gonna find bugs and exploit them.

因为他们独自发现了大量零日漏洞，以及众多基础设施和软件，即使与政府关系不佳，他们还是把这技术交给了政府。

And because they found they just alone found so many zero day exploits and so much, you know, infrastructure and software, they're you know, even with bad relationships with the government, they're giving this to the government.

他们正在把这技术提供给所有主要机构，并告诉他们：看好了。

They're giving this to every major organization and telling them, look.

用它来尝试在类似问题外泄之前修复它们。

Like, use this and try to fix it before something like this gets out.

另一件我觉得重要的事是，大家都说：那他们为什么不干脆不发布呢？

And the other thing that I think is important is everyone's like, you know, well, why don't they just, like, not release it?

既然这么危险，为什么不永远保密呢？

If it's so dangerous, why don't they keep it forever?

而现实是，这些模型正变得越来越好，而中国那边迟早有人会做出这个模型的开源版本并发布出去。

And the reality is these models are all getting better and better, and someone in China is gonna make an open source version of this and release it either way.

所以我认为，最好的做法是尽快拿过来使用，抓紧修复软件漏洞，因为如果Anthropic能造出来，其他人最终也必然能造出来。

So I think it's in everyone's best interest to take this, use it to fix the software as fast as possible because if Anthropic was able to create it, other people inevitably are gonna be able to create it eventually as well.

上个月，Anthropic意外泄露了约2000个源代码文件，以及超过五十万行与Claude Code 2.188版本发布失误相关的代码。

Last month, Anthropic accidentally exposed about 2,000 source code, files and more than half a million lines of code that was kind of linked to a mistake in the launch of version 2.188 of Claude Code and their software package.

这家公司意外导致了上千个GitHub代码仓库被下架，因为他们试图清理这场混乱，并发出了停止并终止函。

The company accidentally caused off, you know, a thousand code repositories on GitHub to be taken down because they were trying to clean up the mess and they were, you know, launching cease and desists.

此外，我认为很多人不知道的是，Anthropic目前的收入正在急剧增长。

In addition, I think what not a lot of people know is that Anthropic right now is absolutely exploding in revenue.

如果你看一下数据，Anthropic现在的增长速度有多快，他们几天前发了一条推文，称其年化收入已超过300亿美元，而2025年时仅为90亿美元。

If you take a look at the numbers, just how fast, Anthropic is growing right now, they put out a tweet a couple days ago where they said, our run rate revenue has surpassed $30,000,000,000, up from 9,000,000,000 at the 2025.

随着对Claude的需求持续加速，这一合作为我们提供了跟上步伐的计算能力。

As demand for Claude continues to accelerate, this partnership gives us the compute to keep pace.

所以收入正在爆炸式增长。

So the revenue's exploding.

他们正在建立大量这样的合作关系。

They're making a lot of these partnerships.

我的意思是，2025年他们的年化收入是90亿美元，现在已超过300亿美元，是去年年底的三倍。

I mean, the 2025, they were at $9,000,000,000 in run rate and run rate revenue, and now they're past 30,000,000,000, triple since the end of last year.

我的意思是，我们才刚进入今年三个月。

I mean, we're three months in.

所以这简直是在爆炸式增长。

So this is absolutely exploding.

OpenAI 感到担忧。

OpenAI is concerned.

大家都很担忧。

Everyone's concerned.

显然，软件行业对即将发生的事情感到忧虑。

Obviously, the software industry is concerned with what is, you know, coming down the pipe here.

有趣的是，关于去年年底那90亿美元的情况，他们提到，在二月份宣布G轮融资时，我们曾表示有超过500家企业客户每年的支出都超过100万美元。

Something that's interesting is as far as that whole $9,000,000 at the end of last year goes, they said, when we announced our series G fundraise in February, we shared that over 500 business customers were each spending over $1,000,000 on an annualized basis.

而今天，这个数字已经突破了一千，不到两个月就翻了一倍。

Today, that number exceeds a thousand, doubling in less than two months.

这太疯狂了。

That is crazy.

他们的增长简直堪称天文数字，我认为Anthropic真正做得出色的是，OpenAI主要瞄准普通用户，这些人可能每月只花20美元，很多人甚至免费使用。

Their growth is absolutely astronomical, and I think where Anthropic really crushed it, OpenAI is kind of targeting the everyday user who maybe will spend $20 a month, and many will just do it use it for free.

Anthropic 的目标客户是企业用户。

Anthropic is targeting business users.

我个人每个月花几百美元在上面，乐此不疲，因为我的工作效率提升太多了。

I personally am spending hundreds and hundreds of dollars a month on it, loving every second of it because I'm getting so much done.

但我觉得他们非常了解自己的客户。

But I think they they know their customer.

他们找到了那些真正把 AI 推向极限的重度用户。

They're they're finding the power users that are really pushing AI to its limits.

而且，就连把 AI 提供给这些网络安全人员的情况来看，他们本质上是制造了这个问题。

And, I mean, even in the case of giving it to all these cybersecurity people, it's like they they basically made the problem.

他们说：我们做了一个如此出色的模型。

They're like, we made a model so, you know, good.

它发现了所有网络安全问题，现在你必须用我们的模型来解决我们自己制造的问题。

It discovered all of the cybersecurity issues, and now you need to use our model to fix the problem that we basically made.

所以他们虽然免费提供，但公平地说，他们承诺了大约一亿美元。

And so they're giving it out, but they are in all fairness, they are pledging about a $100,000,000.

他们正在以积分和令牌的形式提供给这些不同的公司，然后说：看。

They're giving to all of these different companies in credits and tokens, and they're like, look.

我们给你们一亿美元，让你们去运行并修复世界上所有的软件，因为我们知道是我们制造了这个问题，而且我们想把模型推广出去。

We're gonna give you guys a $100,000,000 to run through and fix all of the software in the world because we know we made this problem, and, we wanna get the model out.

这非常有趣。

So that's pretty fascinating.

他们实际上在付钱给微软，让其修复世界上这些安全漏洞，因为他们的模型即将彻底颠覆一切。

They're literally paying Microsoft to fix these security vulnerabilities of the world because their model is about to crush it.

大家，非常感谢今天收听这个播客。

Everyone, thank you so much for tuning in to the podcast today.

如果你喜欢这一集，我的天，这真是一场疯狂的旅程。

If you enjoyed this episode, I mean, this was an absolute wild ride.

一定要测试OpenAI、Anthropic和Gemini的所有最新模型。

Make sure to test all of the latest models from OpenAI and Anthropic Gemini.

把它们放在一起对比测试。

Test them side by side.

我认为理解这些模型的所有能力非常重要，你可以在 aibox.ai 上以每月 8.99 美元的价格做到这一点，而且你还能在同一个平台获得音频、图像、视频等所有功能。

I think I think this is so important to understand the capabilities of all these models, and you can do that at aibox.ai for $8.99 a month, and you also get audio, image, video, everything in one place.

希望它能为你带来卓越的体验。

Hope that it is a phenomenal product for you.

我为此投入了大量的心血和汗水。

Put a lot of blood, sweat, and tears into it to it.

所以告诉我你们的想法吧。

So let me know what you guys think.

希望你剩下的时间过得愉快，我们下一期再见。

Hope you have a fantastic rest of your day, and I will catch you in the next episode.