Research Scientist @ Collinear AI | PhD @ Cornell Defensive Cybersecurity
Sunnyvale
Joined July 2020
- Tweets84
- Following83
- Followers150
- Likes321
I am not crazy! I know they sold us the same data. I knew it was the same. Down to the same typo in row 4,821. As if I could ever make such a mistake. Never. Never! I just – I just couldn't prove it. They covered their tracks, they got that idiot at the data brokerage to lie for them. You think this is something? You think this is bad? This? This chicanery? They've done worse. That exclusivity clause! Are you telling me that two vendors just happen to have exclusive rights to the same data? No! They orchestrated it! They sold it to us twice! And I bought it! And I shouldn't have. I made them a preferred vendor! What was I thinking? They'll never change. They'll never change! Ever since they were founded, always the same! Couldn't keep their hands off other people's data! But not our vendors! Couldn't be our preferred data vendors! Selling it back to us! And THEY get to be featured on our blog? What a sick joke! I should've stopped them when I had the chance! ...And you, you have to stop them!
new GTM strategy: hack a company, dump a sample of defensive cyber data, then book a 15-minute intro call
4
10
673
If we're want to improve defensive cyber capabilities for all models we'll need to do it as a community.
By popular demand we’re open-sourcing CWE-Bench on Hugging Face.
AI practitioners can now access frontier cyber evals and understand what makes cyber data high-quality. We would love feedback and contributions on results and improvements.
Each CWE-Bench task gives an agent a real open-source repository and an audit instruction. The agent must find and fix the vulnerability without being told what it is or where it occurs. Deterministic verifiers check that the fix blocks the exploit and preserves legitimate behavior.
This is the largest Cyber release in the AI community!
Learn more on the HF blog.
Excited to see what you build.
With the ease of access to expert level offensive capabilities from agent, I expect many more irresponsible leaks like these from bad actors. It is crucial for enterprises to be up to date on the SoTA for defensive capabilities to mitigate damage to themselves.
This quoted post is unavailable.
There is quality control for vendor data that frontier labs buy to ensure their models don't go to shit; I'm sure you can add checks on model-generated data to avoid incentivizing killing humans (unless we want to benchmaxx that, in which case I'll share you samples)
To be clear, as we say in our latest Risk Report (teapawt.net/AnthropicAI/status/208…), I think the risk from present models is low. What I am worried about is superintelligence arising from recursive self-improvement, as we have said is happening faster than we thought (teapawt.net/AnthropicAI/status/206…).
1
4
802
Today we’re releasing CWE-bench: 100 held-out audit-and-patch tasks testing whether coding agents can defend real code.
The leading agent passes 47%. 18 tasks remain unsolved by any agent.
This means frontier models on our benchmark have de-correlated errors.
Blog: blog.collinear.ai/p/cwe-benc…
sometimes I lose my Claude Code sessions, so I made a Claude Code session to find my Claude Code sessions
2
3
213
Great collab with @aditjain1980 on this. Was surprised that Fable appears to have similar cybersecurity gaps to many other frontier models. Will check out how this trend holds when the govt unbans usage but concerned that it can't reliably patch vulns without repeated tries
1/n
We benchmarked the top-4 models for solving real-life cybersecurity vulnerabilities on a collection of 221 tasks which covering more than 150+ CWEs.
And found some interesting patterns..
1
6
1,697