New serious vulnerabilities spiked around release of Claude Mythos Preview

Post by solenoid0937 » Sat, Jul 04, 2026, 5:07 PM UTC

pratikel wrote: post #66

denverllc wrote: post #54

One of the major differences between Amodei’s and Hagseth’s views is that Hagseth said that in their world they don’t distinguish between “defensive” and “offensive” capabilities. In other words, a weapons missle defense system is equivalent to an attack one. I think that applying this thinking to software is a mistake. A lot of commercial software uses open source libraries under the hood, and and while the large co…

OpenAI gives access to cyber models for open source maintainers https://openai.com/index/patch-the-planet/

Post by moomin » Sat, Jul 04, 2026, 5:24 PM UTC

no-name-here wrote: post #19

cperciva wrote: post #17

This is hardly news? We've known for months that a flood of AI-assisted vulnerabilities was coming; I posted on Twitter in March calling 2026 the year of a million CVEs: https://x.com/i/status/2035045573116789002

In pretty much every single HN post on this topic, there are a number of commenters claiming it’s false. Continued quantifiable data like this seems very important at hopefully resolving the ongoing disagreement about the facts.

Post by moomin » Sat, Jul 04, 2026, 5:50 PM UTC

guessmyname wrote: post #26

altmanaltman wrote: post #18

Earlier quoted context omitted.

Its very hard to understand what you're saying with the comment - like you have 10+ years of experience and you verify each bug because you know Mythos can provide fake positives. But other teams (which also should have people equivalent to your skill and experience level) suck at it so much that CVP level workers are having to spend time on their fake reports. Then you say Anthropic should stop theater. Then you say…

I didn’t claim to have 10+ YoE; I said that most of the people in Project Glasswing are security researchers with 10+ YoE (avg). > Its very hard to understand what you're saying with the comment Yes, fair enough. I’m simply trying to shed some light on what goes on behind the scenes without disclosing too much information to avoid breaching the NDA(s) that all Project Glasswing users have signed. There’s a lot of spe…

Post by tiahura » Sat, Jul 04, 2026, 6:46 PM UTC

mft_ wrote: post #58

denverllc wrote: post #54

One of the major differences between Amodei’s and Hagseth’s views is that Hagseth said that in their world they don’t distinguish between “defensive” and “offensive” capabilities. In other words, a weapons missle defense system is equivalent to an attack one. I think that applying this thinking to software is a mistake. A lot of commercial software uses open source libraries under the hood, and and while the large co…

If we take the noise about Mythos' capabilities as read, then releasing it freely into the world could result in chaos, as attackers find myriad new vulnerabilities and use them, and code owners frantically hunt for them and fix any that are exploited. (Noting, of course, how legendarily quick and agile large corporations aren't , compared to motivated individuals or small groups.). Eventually, given unfettered acces…

Post by rurban » Sat, Jul 04, 2026, 7:17 PM UTC

eXpl0it3r wrote: post #76

rurban wrote: post #31

I do maintain dozens of C/C++/Perl projects. I got massive amounts of new good vulnerability reports, more than with the latest fuzzing waves. Fuzzing is still the majority overall, but Opus dominates now. Haven't got any Mythos/Fable vuln yet. And with the help of Sonnet/DeepSeek I can finally get around and weed out all the still existing fuzzing bugs. It has nothing to do with Mythos for me, just people getting An…

Are CVE really a good thing for open source projects? No doubt is it a good thing to have issues reported and fixed, but CVE feels a bit like blackmailing maintainers - either you fix the issue or we get your project flagged with "security scanners". I guess, my distaste mostly originates from randomly assigned high CVE numbers that don't reflect the actual threat. And the fact that it gives the companies which use t…