Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mythos Finds a Curl Vulnerability

daniel.haxx.se

Post reply on HN
Print view View original

251–260 of 298 posts

Re: Mythos Finds a Curl Vulnerability

#251

Post by breakpointalpha »

srcreigh wrote: post #154

I can't help but think that curl is, by nature, a relatively simple and well-contained tool. Compare to an operating system or web browser or database or billion dollar company codebase. It makes some sense that Mythos/ChatGPT 5.5 might be that much better with complexities that curl just doesn't have because it's a basic tool. Like yeah curl is obviously extremely fully featured as an "anything client" but it's orde…

From the post:

"curl is currently 176,000 lines of C code when we exclude blank lines. The source code consists of 660,000 words, which is 12% more words than the entire English edition of the novel War and Peace. ... curl is installed in over twenty billion instances. It runs on over 110 operating systems and 28 CPU architectures. It runs in every smart phone, tablet, car, TV, game console and server on earth."

I wouldn't call that simple or well contained...

Most OS or web browsers don't run on cars or tvs.

Re: Mythos Finds a Curl Vulnerability

#252

Post by janc_ »

spenczar5 wrote: post #176
orblivion wrote: post #173

Earlier quoted context omitted.

Is Firefox less invested in this than Curl? I mean there must be some explanation for this.

It's in the first sentence of your quote: "our continued collaboration with Anthropic" Read this as: "we get discounts, rate limit increases, a direct line to responsible product managers; in exchange we participate in friendly marketing." It's extremely common in this line of business - typical of database vendors, software tool companies, etc.

In many countries it is mandatory to mark any form of compensated advertising as such. If your claim is true they might be breaking some laws here & there…

Re: Mythos Finds a Curl Vulnerability

#253

Post by nicce »

abirch wrote: post #182
anygivnthursday wrote: post #49

Earlier quoted context omitted.

But Mythos is not marketed as a tool that can do the same as other tools already available maybe slightly better, but as a revolution.

I'm agnostic with Anthropic/Mythos but if there aren't any vulnerabilities there it's hard to find it. Until we find vulnerabilities in curl that Mythos missed, it's hard to say how good it is.

Would have like to see analysis against curl repo where the commit level is one day after the Mythos training data cutoff. And disable access to the internet.

Re: Mythos Finds a Curl Vulnerability

#254

Post by hmokiguess »

> curl is one of the most fuzzed and audited C codebases in existence (OSS-Fuzz, Coverity, CodeQL, multiple paid audits). Finding anything in the hot paths (HTTP/1, TLS, URL parsing core) is unlikely.

The way this reads sounds more like the LLM dismissed trying rather than it tried and failed, I've seen Claude do that often unless I probe it to challenge itself, curious here what actually happened.

Re: Mythos Finds a Curl Vulnerability

#255

Post by helloplanets »

AgentME wrote: post #240
helloplanets wrote: post #86

Earlier quoted context omitted.

Anthropic has is quickly destroying customer goodwill by repeatedly pulling the same stunt. Horrible marketing, imho. It's an entirely different thing to have the company conduct research on LLMs in general being a cybersecurity threat, instead of going " our new model is just too powerful" and shift the discussion to revolve around that. It's slimey.

Hasn't almost every new frontier model had an early period of limited access? I don't get why everyone is acting like Mythos is particularly egregious for this.

This is literally how they announced the model:

> We formed Project Glasswing because of capabilities we’ve observed in a new frontier model trained by Anthropic that we believe could reshape cybersecurity.

> Claude Mythos Preview is a general-purpose, unreleased frontier model that reveals a stark fact: AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.

https://www.anthropic.com/glasswing

Re: Mythos Finds a Curl Vulnerability

#256

Post by DANmode »

johnbarron wrote: post #59
therealpygon wrote: post #51

Earlier quoted context omitted.

Anthropic using marketing to convince people their models are more advanced, better built, or that AI is a threat that needs to be regulated because only they have the answer? I’m shocked. More seriously, so far I haven’t seen much indication that Mythos is more than Opus with a security focused code analysis harness. That said, the fact it can find these bugs in an automated fashion is the more important takeaway ou…

>> Anthropic using marketing to convince people their models are more advanced, better built, or that AI is a threat that needs to be regulated because only they have the answer? I’m shocked. I remember when OpenAI was saying GPT-2 was too dangerous to release.

> I remember when OpenAI was saying GPT-2 was too dangerous to release.

The world didn’t end yet - but did it improve?

Re: Mythos Finds a Curl Vulnerability

#257

Post by mistrial9 »

muwtyhg wrote: post #244
mistrial9 wrote: post #225

Earlier quoted context omitted.

"ChatGPT has over 900 million weekly active users worldwide. ... ChatGPT Plus has around 50 million paying subscribers"

What you have typed does not address anything the person you are responding to said. With those 50 million subscribers, how much do they pay and how much do they cost? That is the only relevant piece of information when discussing the investment and returns of OpenAI.

> "invest 5 billion to make 10 million"

business is contextual, and is a game of numbers? If you agree, then there is a difference between "I made money selling lemon drinks at my driveway, but I sold a car to make room" .. versus "I have recurring revenue of 50 million x $80 USD per month, and it is growing, and I am using cheap credit to build that" .. Numbers have a meaning, and the larger dollar recurring revenue cannot be matched in any way, no matter how much I spend. IIR ChatGPT is the fastest adopted software in the history of the Internet.

Re: Mythos Finds a Curl Vulnerability

#259

Post by knowaveragejoe »

pbmonster wrote: post #151
nevi-me wrote: post #97

> These tools and the analyses they have done have triggered somewhere between two and three hundred bugfixes merged in curl through-out the recent 8-10 months or so. If you've just gone through a lengthy analysis of your code with other AI tools, surely it's reasonable not to expect to see hundreds more from a new tool? It should be possible, unless more bugs are introduced, to eventually get to a state where there…

curl had ~15 CVEs in 2026 so far. You surely don't think those (and the one Mythos found) were the last security bugs still left in the code base? There certainly will be more, in fact Daniel predicts ~50 CVEs for the entire year. But Mythos found 1. After all that hype. 1.

Maybe curl is just... better hardened? Firefox posted hundreds in April.

Re: Mythos Finds a Curl Vulnerability

#260

Post by ilia-a »

IMHO Mythos was more of a marketing ploy.

When it comes to security and AI, all top tier publicly accessible models (GPT 5.5, Opus 4.7) and even near-top like Deepseek 4 PRO can do a very good job given detailed harness on how to spot issues and cross-validate them to avoid false positives.

Post reply on HN