Anthropic 发现漏洞的速度快过微软修复速度

5 月中旬的一个下午，数十名微软工程师及其管理人员在线上和公司位于华盛顿州雷德蒙德总部的一间会议室内聚集，讨论 Glasswing 项目。

这家科技巨头正争分夺秒地修复代码中的弱点；一种名为 Mythos 的新 AI 模型正以前所未有的速度发现这些问题。开发 Mythos 的 AI 巨头 Anthropic，已向部分组织提供了访问权限，这些组织开发的软件服务于世界各地的普通用户、企业和政府。目标是在黑客以及中国等对手政府开始利用类似工具发现并利用漏洞、实施间谍活动和破坏行动之前，找到并修复这些漏洞。

与会者刚刚就位，一名工程师便提出了笼罩此次会议的问题：Mythos 是否“达到了 Anthropic 所宣称的预期表现”？

“是的。”一名经理回答道。ProPublica 查看的一份会议录音显示。

微软正在使用的版本 Claude Mythos Preview，发现漏洞的速度已经超过这家科技巨头修补漏洞的速度。这名经理表示，工程师们如今正进行一场“疯狂冲刺”，以缩小这一差距。

当天演示文稿中的一页显示，仅在 4 月，Mythos 就在微软广泛使用的协作软件 SharePoint 中发现了 90 个“严重”漏洞和 141 个“重要”漏洞。在 5 月上半月，它发现的漏洞数量更多。

“拜托，拜托，拜托，如果你们的组织还有任何 4 月发现的漏洞，请加快处理，”工程经理 Hans Andersen 恳求与会者。他们大约还有两周时间，“利用这项访问权限尽可能发现更多问题，并尽可能多地做好事”。

他解释说，5 月 31 日“被认为是世界其他地方将会赶上的那一天”。

电话会议上的工程师对这一说法提出追问，其中一人总结了他们的困境：“所以基本上你的意思是，如果它在 6 月 1 日发布，那么到了 6 月 2 日，对手就会掌握我们的漏洞？”

On an afternoon in mid-May, dozens of Microsoft engineers and their managers gathered online and in a conference room at the company’s Redmond, Washington, headquarters to discuss Project Glasswing.

The tech giant was racing to fix weaknesses in its code that a new AI model known as Mythos was uncovering at an unprecedented clip. The AI behemoth Anthropic, which developed Mythos, had given access to select organizations that make software used by regular people, companies, and governments across the world. The goal was to find and fix the vulnerabilities before hackers and adversarial governments like China began using similar tools to find and exploit them for espionage and sabotage.

As the group settled in, one engineer asked the question that loomed over the meeting: Did Mythos “live up to the hype that Anthropic claimed it would have had?”

“Yes,” a manager responded, according to a recording of the meeting viewed by ProPublica.

The version being used by Microsoft, Claude Mythos Preview, was surfacing bugs faster than the tech giant could patch them, and engineers, the manager said, were now in “a mad dash” to close the gap.

One slide in that day’s presentation showed that in April alone, Mythos had uncovered 90 “critical” bugs and 141 “important” ones in SharePoint, Microsoft’s widely used collaboration software. In the first half of May it found even more.

“Please, please, please if your org has any April bugs, drive those down,” engineering manager Hans Andersen implored the group. They had roughly two weeks “to find as many things and do as much good as we can with this access.”

May 31, he explained, “is considered the day when the rest of the world will have caught up.”

The engineers on the call poked at that assertion, with one of them summing up the predicament: “So basically you’re saying if it’s released on June 1, then on June 2 the adversaries will have our bugs?”