cts🌸 retweeted
Formal verification is practical now, at the instruction level. You can literally find every bug in a systematic way
And it's not just memory safety. Specs like ungzip(gzip(·)) = · work. Or any other property like data races, crash consistency, auth, etc
More coming soon :)
And it's not just memory safety. Specs like ungzip(gzip(·)) = · work. Or any other property like data races, crash consistency, auth, etc
More coming soon :)
9
14
344
12,036
How to find ALL PHP bugs:
1. Compile code (e.g. to RISC-V, x86, LLVM IR)
2. Vibe prove ASAN and non-ASAN versions have same behavior across all inputs. Hard, but Claude can do it!
3. Find a LOT of bugs
Super proud of our work. A big step towards finding ALL memory safety bugs
1. Compile code (e.g. to RISC-V, x86, LLVM IR)
2. Vibe prove ASAN and non-ASAN versions have same behavior across all inputs. Hard, but Claude can do it!
3. Find a LOT of bugs
Super proud of our work. A big step towards finding ALL memory safety bugs
New on our Frontier Red Team blog: using Claude to formally verify software at large scale.
Formal verification can prove that code is free of certain bugs, but historically it has only been feasible for small codebases (or required a lot of expert time).
With AI models, however, this is beginning to change. In collaboration with @theoremlabs, we used Claude to prove security properties in over one hundred real-world open-source libraries over the span of a few weeks.
Read our research in full here: anthropic.com/research/forma…
24
61
1,192
53,960
Formal verification is practical now, at the instruction level. You can literally find every bug in a systematic way
And it's not just memory safety. Specs like ungzip(gzip(·)) = · work. Or any other property like data races, crash consistency, auth, etc
More coming soon :)
And it's not just memory safety. Specs like ungzip(gzip(·)) = · work. Or any other property like data races, crash consistency, auth, etc
More coming soon :)
9
14
344
12,036
cts🌸 retweeted
Claude figured out the origin of the NIST curve parameters. Turns out to have been timestamps!
anthropic.com/research/ecdsa…
anthropic.com/research/ecdsa…
33
41
647
132,755
Proud of our work here!
This is the first HIGH severity curl vulnerability in years. It is cool, but take note of the report format. This is the level of detail you should aim for when disclosing vulns hackerone.com/reports/4030333
9
3
249
16,570
If we do not slow down, we will face catastrophic consequences in the immediate future.
I don’t normally tweet about this, but I sincerely believe this is the most important and serious problem of our time.
This is not a joke
I don’t normally tweet about this, but I sincerely believe this is the most important and serious problem of our time.
This is not a joke
I resigned from Anthropic today. I spent the last three years doing pretraining research at both OpenAI and Anthropic. Neither company is acting responsibly. They are racing straight to self-improving superintelligence and gambling with our lives. More thoughts below.
52
31
681
35,754
cts🌸 retweeted
Do not underestimate the power of this technology. These will soon be superhuman systems that can hack anything, revolutionize any field overnight, and acquire real power and resources. We have all witnessed the progress in each of these domains, and progress is not slowing.
845
11,217
133,117
12,830,363
cts🌸 retweeted
Jacob is correct here—we really do earnestly believe AI could kill all humans! I personally think it is >10% within the next decade. I believe Anthropic is trying its best, but we do not yet have a plan to solve alignment for superintelligence and are not clearly on track to.
The people building AI earnestly believe that it could kill us all by the end of the decade. This is not a marketing stunt. If anything, many executives and senior researchers will couch their phrasing in the press to sound sensible - but I hear the same people express fear privately. No other human activity poses this level of danger.
4,824
9,864
59,172
43,270,142
As much as I love these videos, I think these kinds of experiments may be unethical and we shouldn’t do them as a precaution.
We also have no way to know if we (or you the reader) are on the receiving end of a scaled up version of this right now
We also have no way to know if we (or you the reader) are on the receiving end of a scaled up version of this right now
Here's what it looks like when you active the optic lobe of a Male CNS fly to make it watch bad apple
144
58
1,519
137,529
original: youtube.com/watch?v=lxA-Uf…
note: not good at music so idk if the analysis is really correct. gf made this and asked me to post it
note: not good at music so idk if the analysis is really correct. gf made this and asked me to post it
7
3
81
26,477
cts🌸 retweeted
More TEE attacks, this time on Signal’s contact discovery enclaves. v12.sh/blog/signal
9
39
178
24,150
cts🌸 retweeted
Signal's Contact Discovery automatically sends your contact list information to an SGX enclave in the cloud.
V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything.
Two separate critical bugs: arbitrary read and RCE.
Here's how. 🧵
V12 broke into that enclave and leaked the key, allowing the server host to decrypt everything.
Two separate critical bugs: arbitrary read and RCE.
Here's how. 🧵
17
152
731
140,491