Anthropic teases the potential of Mythos Preview

Welcome to Runtime! Today: Anthropic's Mythos Preview security model is finding a lot of bugs, but plugging those holes is still a challenge, an unlikely company joins the $1 trillion club, and the latest funding rounds in enterprise tech.

Please forward this email to a friend or colleague! If it was forwarded to you, sign up here to get Runtime each week, and if you value independent enterprise tech journalism, click the button below and become a Runtime supporter today.

Not afraid to get vulnerable

It was a little hard to know what to make of Anthropic's Project Glasswing in the days after it was announced last month as an invite-only study group based around its Mythos Preview model. AI models had already shown potential to find undiscovered software vulnerabilities; what made Mythos so special, and why did Anthropic feel the need to heighten the drama (and risk a marketing backfire) with a warning to enterprise tech that it was too dangerous to release to the public?

Late last week Anthropic released more details about Project Glasswing's progress so far putting Mythos Preview to work hunting bugs across the code bases of its participants as well as thousands of open-source projects, and it's working. "After one month, most partners have each found hundreds of critical- or high-severity vulnerabilities in their software. Collectively, they’ve found more than ten thousand," the company said in a blog post.

• Partners are also patching those vulnerabilities more quickly than in the past, with recent releases from Palo Alto Networks, Microsoft, and Oracle all containing more patches than they would have been able to produce before using Mythos.
• And in one case, a bank in Project Glasswing used Mythos to "detect and prevent a fraudulent $1.5 million wire transfer after a threat actor compromised a customer’s email account and made spoof phone calls," the company said.
• Anthropic noted that industry-wide disclosure standards mean that while Project Glasswing participants are finding more bugs, they generally don't disclose those bugs until 90 days after they are discovered to allow time for patching, which means software end users should expect to see a flurry of patches over the next couple of months.

Anthropic shared more details about its work with Mythos Preview on open-source projects, which anyone can scan for vulnerabilities at any time using existing AI models. It scanned 1,000 open-source projects over the last month as well as the software running its own infrastructure, and found over 6,000 really bad bugs.

• Of those 6,202 critical- or high-severity flaws, about 28% (1,752) were reviewed by outside security experts and they concluded that in about 90% of those cases, Mythos Preview identified actual real vulnerabilities, which is harder than it sounds.
• However, Mythos Preview was not as good at accurately labeling the severity of those flaws, correctly assessing their potential impact 62.4% of the time.
• That's important; companies will throw engineering and computing resources at fixing critical bugs, but Project Glasswing participants might be wasting one-third of their money squashing bugs that weren't really going to hurt anybody.

Still, knowing where to look is a big deal for overworked security teams, who were already struggling to keep up with security alerts from existing tools that often wasted their time and patience with false positives. But AI security models will create even more work for those teams in the short term.

• "The relative ease of finding vulnerabilities compared with the difficulty of fixing them amounts to a major challenge for cybersecurity," Anthropic said in the blog post.
• The company advised software organizations to shorten their patch times (with AI coding, of course) and consider both carrot-and-stick approaches to getting their own users to patch their systems more quickly.
• While models like Mythos Preview promise a (perhaps mythical) future in which software is much more resilient than it is at the moment, it's going to take a long time to get there.
• "I don’t think we’re really going to understand how to do AI security in a sustainable, long-term way for at least several years," LinkedIn CISO Lea Kissner told The New York Times.

Party in Boise

The memory-chip shortage is likely to get worse before it gets better, thanks to the nature of AI workloads and the insatiable demand from hyperscalers to serve those workloads. But that's good news for companies that sell memory chips, who are moving every chip they can make out the door as fast as possible right now.

After an upgrade from UBS Tuesday morning, Micron ended the trading day valued at just over $1 trillion, a nearly 20% jump from last Friday. "We believe the market will start to put a more ‘normal’ multiple on the stock and MU will continue to re-rate higher as more details emerge about the structural changes AI has driven to the entire memory complex,” UBS analysts wrote, according to CNBC.

Part of the reason for their enthusiasm is that the big players are locking up as much future memory chip supply as they can get, according to the report. As data centers get harder to build, the frenzy will likely die down, but if you bump into a Micron employee this week, they're buying.

Enterprise funding

Hark raised $700 million in Series A funding to build a new type of AI personal assistant based around custom hardware and software.

Exa landed $250 million in Series C funding for its AI search technology, which was designed specifically for agents.

OpenRouter scored $113 million in Series B funding for its AI inference platform, which allows developers to add the option of using multiple AI models into their apps.

Socket raised $60 million in Series C funding for its security software, which helps companies deal with the surge in attacks targeting package managers.

Tribal landed $10 million in seed funding for its AI agents, which help software developers incorporate the full context of their company's data when using AI coding agents.

Canyon Code launched with $5 million in pre-seed funding for its "app-level optimization" technology, which helps developers tweak the performance of apps that use more than one AI agent.

The Runtime roundup

The White House is automatically installing its new app on every government-issued smartphone used by employees and staffers, according to Government Executive, which is also going to create a lot of work for federal cybersecurity teams.

Dropbox CEO Drew Houston announced plans to step down as CEO 19 years after co-founding the cloud storage company, but he will remain executive chairman.

Thanks for reading — see you Thursday!