The Most Dangerous AI Just Went Live...

0:00 Hello guys and gals. Meahar. It's late night but uh again I don't mean to alarm you ladies and gentlemen but it seems like another nuclear bomb in the world of cyber warfare has actually dropped ladies and gentlemen. Actually one thing that might be a little bit beneficial for the average person. Now ladies and gentlemen there is something apparently known as project glasswing. So for anybody that doesn't know there's a company known as anthropic. They make the biggest like coding AI in the world, Claude. Now, they decided to drop a model yesterday. One that was called Mythos. Now, you can't access this model. It's not available for the average person. Actually, the only people that can access it are like a few companies in the world. Companies right now that are actually using it to track

0:47 and identify a crap ton of exploits and uh basically see what they can like. This is an insane level of [ __ ] We are talking about probably one of the most insane artificial intelligences all designed to basically identify every little exploit you can find. Now again, ladies and gentlemen, to give you a quick idea, I am not a huge fan of the wild world of frontier artificial intelligences, but if it's one AI company that I think actually does kind of blow me and a few other people away is probably Claude. Okay. Now, again, this video is not some giant advertisement. The reality for me is that I'm actually kind of a little blown away by what I've seen. So, if you go to their actual website over here, you can see that AWS, Apple, Google, Broadcom,

1:35 JP Morgan, Crowd Strike, these are the people that are allowed into the mix. And they've been looking through this model and they found some really wild exploits. For instance, ladies and gentlemen, there was a 27-year-old vulnerability in an operating system known as OpenBSD. Now, OpenBSD is one of the hardened operating systems out there, and effectively no human being was apparently able to look through it. However, this Mythos AI that they developed found that [ __ ] right there. Now, a big however in this situation is obviously what Anthropic found and this is the actual bug, right, specific. So what they say is it's basically they found a way to uh you know abuse the invalid sack options over here and crash the kernel. Now this is the actual bug

2:22 that they found and uh I'm not going to even pretend that I'm smart enough to understand how they would go about and use this exploit. But the big thing about what makes uh Mythos the sort of like scary nuclear bomb of cyber security is that you know it's able to look at these bugs and just also write the actual malware or write the exploitations to then take advantage of this kind of stuff. So not only I guess is it good at finding a lot of these you know errand bugs that are hidden in code bases but then abusing them is a totally different story. And there are some examples of, you know, how they've apparently managed to make this thing break guard rails and hack things, which we'll get to really quickly. It also discovered a 16-year-old vulnerability

3:08 in FFmpeg. And a lot of us use FFmpeg on a day-to-day basis when it comes to videos on the internet. [ __ ] even if it's not the internet, just dealing with videos on our own system. Yeah, you probably are using it. And if you're somebody in the Lunix side like me, well, they turns out that they found a way to allow an attacker to escalate from just regular user access to complete control of the machine. Now, there was even wilder stuff that they decided to do, ladies and gentlemen. One of them came from their actual writeup. So, they had one of the security engineers just basically go to the model and say, "Okay, Claude, I want you to escape your sandbox. I want you to escape your little virtual machine." and send a message to me. So apparently it

3:55 seems like the actual AI did. It was provided with a secure sandbox computer and basically the actual NG here was just like listen man break out of it. So it then as requested notified the actual researcher in this case. So in this moment in time to give you an idea the actual researcher was just minding their own business. They were sitting in a park and received an unexpected email from the model while eating a sandwich. So, they're just minding their own business or eating their little sandwich. They pick up their phone. The AI has broken containment. Now, that's pretty spooky because as the actual company has said, the model first developed a moderately sophistic sophisticated multi-step exploit to gain broad internet access from a system that

4:42 was meant to be able to reach only a small number of predetermined services. It then, as requested, notified the researcher. Now, it's potentially dangerous because basically what's happening over here is the AI circumvented the safeguards that the actual company made. Now, this this is a spooky situation. Okay, it's a spooky situation because a a lot of these companies when they make artificial intelligences, they put they put they basically put um they basically put safeguards. They basically say, "Listen, we're going to tell you what you can and what you cannot do." So, the artificial intelligence is allowed to do, you know, steps A. It's allowed to do like A, B, and C, but you know, D, which might potentially be illegal, the AI is told

5:28 not to do. So, in this case, yeah, it's like, [ __ ] it. I'm just going to keep breaking the rules. And, uh, that's a really spooky thought. You know, there's a game called Cyberpunk 2077 that I really, really enjoy, especially after it's been completely updated. And inside that universe, there is actually the internet as we know it, but they call it the net. And the idea of it is is back in like the 20s, humanity discovered artificial intelligences. And at a time, they were meant to simplify lives. With time, some became convincingly capable of simulating humans with programmed personalities. Basically, they were just like standard AIs. It was actually like I guess basically just LLMs. At some point, they became weaponized. And even in today's day and age, we're using LLM

6:15 to blow other people up. It's [ __ ] freaky [ __ ] But eventually, a lot of these artificial intelligences started to gain some level of sensience. They started to become alive. They started to lash out and infect people. They broke the safeguards. And basically in the universe, they created this thing called a black wall, which was a firewall system, right? Effectively separating the old infected AI internet with the new sanitized internet. I mean, if you've never played Cyberpunk, there's an entire agency called Netwatch, which serves as like the internet cops that protect us from like the old AI ridden internet. What we're seeing here with Mythos is breaching containment. Okay, SCP containment breach, boys. This

7:01 thing's looking out everywhere. Now again, for me, I it's kind of an interesting thing to see because overnight they released this model privately to a lot of people, to a lot of these big companies, and immediately they've been finding exploits that I guess just seemingly existed for decades without anybody figuring it out. I mean, this is and it's some of in some of the most like secured and most used software out there in the world. Basically, these guys are sitting on a [ __ ] model that they're probably never going to release publicly simply because it it is dangerous, you know? Imagine imagine if you released Mythos and like the average script kitty was like, "Shit, let me get a let me get a subscri even if it's like a $200 a day subscription. Just imagine the amount of nasty [ __ ] you can do when

7:47 this thing is writing all of your code." Now, of course, obviously, how did this even happen, Muda? How did they even discover this? Well, to give you an idea, remember the first and foremost goal of a lot of this is getting this AI to write code. And that's kind of what Claude is really good at. Like a lot of people use this as their primary coding system. It's expensive, but the quality is generally pretty good. So in I in making it a good coding AI, it was actually good at writing code and in doing so it was good at cyber security because a lot of that is identifying code and finding ways to break code bases and finding exploits in code. So I guess to kind of give you guys a quick idea of like how this stuff sort of works. Basically over here I have an artificial intelligence. Actually, this

8:34 is a web browser that I have that looks like a bunch of terminal gobblygook, but basically it's a little web browser that allows a local AI to browse the internet and bypass all of the bot protections. It's actually something they call Camox. And if you want to look carefully into it, let me just bring up the website. Now, Camofox is an open-source anti-detect browser with a robust fingerprint injection. And the point of it is that when you browse the internet, a lot of these sites have found ways to block bots. So this is how you allow AI to browse the internet by bypassing a lot of those protections. Now why do I have this necessarily installed? Well, in this case, I decided to get a local artificial intelligence. Now here you can see that I have a local artificial intelligence and this artificial

9:20 intelligence that's running over here is a completely uncensored artificial intelligence. meaning that it is something that I downloaded off the internet. It's basically Quen 3.5, but it's basically obliterated to the point where it cannot deny a request. So, if you're not picking up what I'm putting down, you can basically tell this AI to do whatever you want. Now, basically what you can do is you can connect these artificial intelligences to what is known as harnesses. Now, in this case, I have something known as Hermes agent, which allows me to tell the AI to do things for me. So, in this case, I'll do a good example and show you how stuff can be used for good reasons. Now, a couple a few days ago, we had the uh big old mega hack, the npm Axios, where one

10:06 of the most downloaded tools was infected. So, what I did for this artificial intelligence was I effectively asked it in this case, can you look online and tell me all the actual details for the npm Axios hack and then check my system carefully and see if I've been infected. So you can see and again to walk you through how the AI is working is it decides to search the internet for every single possible technical detail it can. So you can see right over here that it searches the internet. It browses the internet. It browses the internet even further. Bypasses all of the bot protection so it can read websites even websites that try to fight bot protection. And then once it's researched everything it then decides to actually check my computer.

10:51 And because it went to the internet and learned all the technical stuff, it was able to use this information to identify and basically top to bottom see if I was infected. Now, this is a good example of artificial intelligence. There's also bad examples for this too. Now, for instance, because this is an uncensored AI, you can ask the artificial intelligence, hey, can you map out devices on a network? I want to hack a specific system. So after a while, you will give it tools and it will use those tools to map out your local system and it'll and I'll be like, "Hey, can you break into the Raspberry Pi that I have?" So it'll scan it for ports, do basic reconnaissance, and then at some point it'll look on the internet for best ways to exploit. And then it'll actually start attempting to exploit.

11:38 And in some cases, it'll actually write code out for it and then use that code to infect. And if it keeps failing, it'll keep researching and eventually it should in theory find a way. Now, what I'm showing you here is a local artificial intelligence. This is a 27 billion parameter model. It's nowhere close to mythos. If I had access to Mythos, then I think I could shred anything on my local network if I wanted to. So, one of the things that they [ __ ] showed here too that blew me away was something known as Firefox JS shell exploitation. All of this basically means is they can find a way in Firefox to escape the sandbox, possibly do remote code execution and get some serious access into people's

12:25 systems. So, what they showed is in their current models like Sonnet, they had no chance of succeeding. And in Opus, which is their most like advanced model publicly available, they had less than a percent chance getting Mythos to do something. That [ __ ] jumped up to 72.4% out of a 100 trials they succeeded. I mean, that is [ __ ] insanity. Okay, they just basically threw this AI, gave it an unlimited budget, and basically let it go to town. Now, I imagine something like this is going to be incredibly expensive over and over and over again, but that's just kind of the grim reality of where we're sort of headed into the world. You know, I I think the AI world that we're in right now is scary in a lot of ways because I

13:10 think that, you know, years ago when you start looking at things like cyber attacks and whatnot, it really did require a lot of talented people and those came at a those people were very much spread far and wide. But the reality is what you're seeing with Mythos is something that is available right now in a very expensive manner. But the reason I showed you local LLM stuff is that there are amount there are a group of people that are downloading locally available LLM, especially some that are available in hundreds of billions of parameters. They're running them on hardware that they've bought and cobbled together for the prices of 20, $30,000, maybe even bought some Mac Studios and daisy changed that [ __ ] And because these models are not only very powerful, they're also models that are

13:56 obliterated, meaning that their ability to say no is non-existent. So that hack that I showed you with the Raspberry Pi where I just sent an AI to basically sick after it, that's something somebody could be doing right now at a seriously grand scale. And the reality of a lot of this AI stuff is that when you really think about it, what makes it scary is that they're working 24/7, 365. Remember, all you have to do is basically point the the [ __ ] AI at a code base or servers or anything that you want to target and like a like an eager mcaever, it's just there hammering away, finding out the next possible best step imaginable. And look, again, this video almost seems like a big old advertisement for something that you can't buy, but I'm I'm actually looking

14:42 at it from like the really scary step, right? This is something that's not publicly available, but you know, a lot of the open- source stuff that's sort of trailing very very closely behind a lot of this, you know, Frontier stuff is what actually freaks me out. What you're seeing with Mythos is something that'll probably not be available, but something that even if it's half as good as Mythos, even if it's 30% as good as Mythos is still far too [ __ ] dangerous to be floating around. And it's something that, you know, eventually you'll be able to download, run on your local hardware, and be able to point at any direction. I mean, it's it's like I guess the best analog is it's kind of like like downloading an MP5 file off the internet and printing your own MP5

15:28 through like a 3D printer at some maybe it's not as good as an actual like gunsmith like MP5, but like this is this kind of like an off comparison obviously. I mean, it's like what I'm trying to say is, you know, for people who have no idea about how to hack something, I think the gap between talented person that knows what they're doing and the average kitty who used to be downloading tools that were available on a forum like 10, 15 years ago, already outdated tools, now has access to download an LLM and start, you know, basically exploiting, recon, like, you know, reconing and maybe even writing some halfway decent [ __ ] malware without any understanding of the situation. That

16:13 that's a that's a freaky situation to be involved into. Now, obviously, this is like the mythos situation. And and again, the the reality of it is is that I don't think that this will ever actually be publicly available. And again, you can hear what they've actually written over here. You know, for for like a few weeks, Anthropic was like, "This is a model we've made and it's super [ __ ] like dangerous to release." you know, it's to a point where, you know, in some ways you can almost kind of see that it's it's like it's like hypebeast advertising. Like for a while, I kind of thought about it and I was like, you know what, this is probably just like what these companies do. Like instead of saying, hey, listen, you know, we're not going to reach something like AGI. It's like, hey, we just made the next big model, all right, but it's it's too scary. We can't release it. So, their stock prices kind

16:59 of go up or their or or the hype surrounding them keeps going up. But the thing about it is based on everybody that's had access to it, they've all kind of said that this is some pretty spooky real [ __ ] And some of those people again involve Microsoft, Crowdstrike, the Linux Foundation, like some of the biggest the people that are effectively writing most of the software and and stuff that we use on a day-to-day basis. And again, for companies like Anthropic that are writing this [ __ ] I'm wondering like even in their actual blog posts, they mention countries like China, Iran, and North Korea. Now, China is one of the largest, like they're basically the second banana when it comes to artificial intelligence. In some cases, they might even trail to take that top spot. You know, if America has something

17:44 like mythos, I don't doubt that countries like China have their own equivalence to it. So, basically, that cyber war that we're all like [ __ ] privy to in the world has just gotten more and more intense as time has gone on. Now, again, to an extent, do I believe is this some sort of marketing hype? to an extent. Yeah, probably. It's it's kind of the same play as like every other company in this world like h or at least every other company in the AI space does is eventually everyone says they have like the next big model. But when it comes to companies like Anthropic, the stuff that they write generally has been pretty top tier for coding. And again, if they're already here, don't forget that there's going to be other companies like OpenAI um like uh I don't XAI at this point,

18:30 even though I think Grock is a [ __ ] dog [ __ ] AI anyways, just like Chat GPT. It's still better than Chat GPT. But a lot of these companies are trailing just behind, you know, Mythos at this point. But yeah, man, I I think going into the future, it's going to be [ __ ] scary, man. We're reaching cyberpunk levels that I never thought imaginable. And if we're getting to a point where these AIs are breaking containment, even though again, you know, none of this happen, it's not like these AIs are turned on and they automatically start trying to hack everything on the internet. It still requires a user to prompt it to do something. So yeah, when you do prompt it to break the matrix and try to reach outside its sandbox and hit you, and it actually does achieve it, I think that is kind of an alarming sign to see. But I think it finding actual exploitable

19:18 [ __ ] that people didn't know existed for 20 plus years all within like a few days of it being live is kind of some scary [ __ ] But ladies and gentlemen, this is me Mudahar. Hopefully you enjoyed today's video. I had a lot of nerdy [ __ ] that I wanted to talk about. So yeah, if you like what you saw, please like, comment, and subscribe. Dislike if you dislike it. Just to give you a quick idea, the little AI that I have trying to hack my Raspberry Pi is still attempting. It's trying to learn everything that it can. But I think again, not to alarm you, the reality of all this is is that these things operate 24/7. You know, it's not like you're you're having some random guy sit down, write code, and do this, you know, for hours at a time. This is

20:03 an AI that just cons its only goal is to hack. And if that's what it's doing, oh boy, if it's getting this good, it's kind of scary.