you are viewing a single comment's thread
view the rest of the comments
[–] 76 points 6 months ago (4 children)

A big detail nobody seems to bring up about Project Glasswing is that they didn't just prompt it "Hey, check out this codebase looking for issues" and out popped zero days. They ran each project through tens of thousands of dollars worth of compute time. Iteration after iteration and after all that they accumulate a report. Now they've reached out to some of the most cash flush companies to say "we can do the same for you."

Put your quarter in the one armed bandit. Maybe you'll get a zero day but more than likely you'll get a "better luck next time." But please, keep paying us. In 10,000 more iterations we'll surely find the bug that would have cost you millions.

  • source
  • hideshow 4 child comments
  • [–] 8 points 6 months ago* (last edited 6 months ago)

    A competent pentest already costs in the tens of thousands of dollars, and we're also not guaranteed to find anything. Some of the bugs that were discovered by Mythos existed in long standing code bases for a very long time and were not previously known. I would definitely not write off those capabilities.

  • source
  • parent