The Flood is Coming And The Pipes Were Already Full
An update on Athena, and some unsolicited predictions on what's coming next On Saturday, Dario Amodei published We Must Pace the Frontier .
An update on Athena, and some unsolicited predictions on what's coming next On Saturday, Dario Amodei published We Must Pace the Frontier .
I've spent the summer looking at what these models find, and the gap he describes between what they can do and what the rest of us are ready for is the one I've been staring at since May.
The hardest piece of his plan is the one that asks governments to coordinate.
The consumption end is ours: the disclosure processes, the patch pipelines, and the software itself, everything that has to absorb what the models produce.
This post is a status report on how we're spending it, in three parts: The short version: I'm more worried than I was in May, and more sure about what to do about it.
Where governments can act is on consumption: not what the models can do, but what happens to what they find.
It's a model pointed at the power grid, the water system, the hospital network, all of it running on decades of software with the same exploitable design.
Consumption is where it does damage, and that's the end you can still defend; a big share of what the models find only affects old versions, because the models scan what's actually deployed, and what's deployed is old.
Who gets a vulnerability first, how fast a fix reaches the people running the code, whether the operators who can't move on an attacker's timeline get a head start.
All 50 are silent fixes: vulnerabilities already fixed at head, sometimes years ago, where nobody ever filed a CVE; your scanner has nothing to say about them, and the old versions are still running everywhere.
The intake numbers are public: more than 40,000 findings, 42% of them critical or high, across more than 500 projects, with more than 2,000 patches produced.
Two systems fail at once with silent fixes, and neither is anyone's fault.
Upstreams typically won't merge fixes to old versions, and they're right not to: the code was rewritten years ago, there's no branch to merge into, and upgrade is the correct answer.
Plain .patch files, in a public Chainguard repo that says exactly what it is on the tin, under the project's original license.
What happened
An update on Athena, and some unsolicited predictions on what's coming next On Saturday, Dario Amodei published We Must Pace the Frontier .
I've spent the summer looking at what these models find, and the gap he describes between what they can do and what the rest of us are ready for is the one I've been staring at since May.
The hardest piece of his plan is the one that asks governments to coordinate.
What changed
The consumption end is ours: the disclosure processes, the patch pipelines, and the software itself, everything that has to absorb what the models produce.
This post is a status report on how we're spending it, in three parts: The short version: I'm more worried than I was in May, and more sure about what to do about it.
Who is affected
Where governments can act is on consumption: not what the models can do, but what happens to what they find.
It's a model pointed at the power grid, the water system, the hospital network, all of it running on decades of software with the same exploitable design.
Why it matters
Consumption is where it does damage, and that's the end you can still defend; a big share of what the models find only affects old versions, because the models scan what's actually deployed, and what's deployed is old.
Technical details
Who gets a vulnerability first, how fast a fix reaches the people running the code, whether the operators who can't move on an attacker's timeline get a head start.
All 50 are silent fixes: vulnerabilities already fixed at head, sometimes years ago, where nobody ever filed a CVE; your scanner has nothing to say about them, and the old versions are still running everywhere.
Response
The intake numbers are public: more than 40,000 findings, 42% of them critical or high, across more than 500 projects, with more than 2,000 patches produced.
Two systems fail at once with silent fixes, and neither is anyone's fault.
What security teams should do
Upstreams typically won't merge fixes to old versions, and they're right not to: the code was rewritten years ago, there's no branch to merge into, and upgrade is the correct answer.
Plain .patch files, in a public Chainguard repo that says exactly what it is on the tin, under the project's original license.
Attribution
The Hacker News: An update on Athena, and some unsolicited predictions on what's coming next On Saturday, Dario Amodei published We Must Pace the Frontier .
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.