IT managers vs Mythos: Get ready for six months of update hell!

Only a fool makes predictions, especially when it comes to AI, but I’m going to stick my neck out. I know the biggest effect that AI will have in the next six months, and I know exactly who it’s going to affect the most. Me. Or at least, IT managers like me.

First, let’s go back to a simpler time when we had software rather than apps. At that point, users often asked when does a piece of software ever get finished? One common answer back then was “when we’ve sorted all the bugs”, but that’s not strictly true.

The real answer turned out to be: “When the majority of it works”, soon followed up with, “but don’t worry, we’ll fix the rest with patches later.” That was the way things worked for decades, with the internet accelerating the effect as it allowed earlier releases followed by a stream of downloaded patches.

We have a day each month called Patch Tuesday when most companies, Microsoft in particular, like to release patches. Your IT department looks through them and decide what to patch and in what order. Or they wait two weeks for others to test and then apply everything. Or whatever their policy says… there is a policy, right?

Let us now return to the present.

Arrival of Mythos

Anthropic is most famous for its Claude AI model. But a couple of months ago it created a new AI frontier model called Mythos, one which it already said is too dangerous to let people have access to. You may even remember the US government banning a version of Mythos from non-US citizens when it was discovered to be too powerful.

Here’s why. Mythos was created to find bugs in program code. It appears to be excellent, too, and can chain multiple coding issues that it finds and then produce examples of what it can do by “hacking” the system it has been given access to. It can even reverse-engineer binary code back to source code.

The reason it’s so dangerous is that final bit. The ability to take a binary file and chain vulnerabilities together and then produce exploit code; in other words, to create a program that can do something it isn’t supposed to do. 

When Anthropic realised what it had created, the company gave Mythos access to a number of open-source projects. It soon found bugs from 27 years ago in a hardened operating system call OpenBSD, along with a 16-year-old code in FFmpeg that’s used everywhere to encode and decode video. It also hacked the Linux kernel, amongst a number of other open-source projects.

Anthropic isn’t telling anyone about the exploits as they aren’t fixed, but we know it also found problems in every major web browser.

The knock-on problem

So Anthropic has set up a system where the big players in software can user the Mythos AI model to check their own closed source code for issues. Firms like Microsoft, Cisco, Apple, Amazon and Google. I’m sure other companies are already on that list.

Why am I talking about this now? The problems seem to have been sorted, surely? Well, no.  What about the old code that’s still relied upon but that companies no longer support? I can tell you right now that it’s almost certain to be in use, sitting out there in binary form on thousands of computers.

As I said at the beginning, software isn’t perfect. It’s mostly “good enough”. Then along comes a very capable AI able to do things with this code that humans can’t. That is, review each line or block of code with interest and understanding. Quite apart from skills, it has patience that humans don’t. It’s happy to spend the time looking at old code and try to break it.

For now the US government has clamped down on access, but Anthropic hasn’t got a secret sauce for this AI model. The other AI firms – in other countries – are just behind them and will likely match or better Mythos shortly. Unlike Anthropic, they may not care about the problems it could cause. Or they might have a different agenda. 

So we have to assume that a lot of old code that’s in place is about to be looked at by AI with fresh eyes and that millions of old bugs are going to come to light. Some of these are likely awful and will require immediate patching.

The next six months

Which brings me to my “what AI is going to do in the next six months” prediction. There is about to be an AI arms race, with AI finding holes in code and programs and sending the results to the people in charge of that code to fix.

These people will have to triage a blizzard of bug reports into an order of bad to worse. They must produce some kind of patch and rush it out out quickly. Some of the bugs will be trivial, but it will take time to know this.

But it’s not just the software developers. Your IT team is going to get many more patches offered and must decide which order to apply these patches. Including the patches that fix bugs so awful that they require immediate attention.

In the background, you’ll have the bad guys who will be using AI to exploit the bugs it finds and use them to break in to systems, rather than report the fact it has found a problem

This is the same battle we have been doing for years, but the intensity of the next six months is likely to get very serious. I feel bad for me and other IT teams.

Wish us luck!