Skip to content

Back to the catalog

Mythos AI Security Testing
daniel.haxx.searticle

Mythos AI Security Testing

Daniel Stenberg recounts curl's first security scan using Anthropic's unreleased Mythos AI model (obtained via Linux Foundation's Alpha Omega program under 'project Glasswing'), which analyzed 178K lines of curl's src/ and lib/ code and reported five 'confirmed' vulnerabilities that the curl security team whittled down to one low-severity CVE (three false positives, one 'just a bug'). He contrasts Mythos with curl's ongoing use of AISLE, Zeropath, OpenAI Codex Security, GitHub Copilot and Augment code, concluding AI scanners are genuinely valuable for finding known bug classes at scale but that Mythos itself showed no evidence of the 'dangerous' capability hyped by Anthropic's media messaging.

TL;DR curl's maintainer reports Anthropic's Mythos AI found just one real (low-severity) bug in curl after AI-hype triage, undercutting the model's 'dangerously good' marketing.
Open original ↗

Organisations named here

  • Alpha Omega
  • Linux Foundation

Technologies named here

  • curl
  • Mythos
  • curl 8.21.0
  • AISLE
  • Zeropath
  • OpenAI's Codex Security
  • GitHub Copilot
  • Augment code
  • OSS-Fuzz
  • Coverity
  • CodeQL
  • Anthropic
  • OpenAI Codex
  • Project Glasswing

Techniques named here

  • CVE-to-variant-hunt mapping built from curl's own vuln.json
  • AI-assisted pull request review

Related in AI Security