Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mythos Finds a Curl Vulnerability

daniel.haxx.se

Post reply on HN
Print view View original

281–290 of 298 posts

Re: Mythos Finds a Curl Vulnerability

#281

Post by fpesce »

yjftsjthsd-h wrote: post #245
fpesce wrote: post #65

Earlier quoted context omitted.

I don't agree with the "no tsunami in sight": if you don't look at 100+ bugs in Firefox and many more OSS projects, bunch of old unseen-before OpenBSD/Linux RCEs, and a few LPE in just 2 or 3 weeks for Linux itself... IMO, this does not sound like marketing scare, there is spike of vulnerability disclosures - high quality, low false positives - that can be sensed... It feels like we're speedrunning through few-years…

> bunch of old unseen-before OpenBSD/Linux RCEs, AFAIK, the only thing it found in OpenBSD was a DoS? Edit: For that matter, I'm not aware of R CEs in Linux, only LPE?

The whole thing started with a talk from Nicholas Carlini mentioning a remote 20+ year old NFS vuln IIRC.

Re: Mythos Finds a Curl Vulnerability

#282

Post by vidarh »

shakna wrote: post #280
vidarh wrote: post #193

Earlier quoted context omitted.

I did not suggest there was nothing to find. But is also very different to count all CVE's found and reported (there are less than 30 total for 2025 and 2026 per [1]) by anyone and everyone vs. what was found in a short time by someone prompting a model. [1] https://curl.se/docs/security.html

Is not the selling of the model, that it is as capable as anyone and everyone? > Claude Mythos is Anthropic's most specialized model, trained exclusively on security research, vulnerability disclosures, and attack pattern literature. Its reasoning reflects how the world's best security researchers think. [0] [0] https://mythosvulnerabilityscanner.com/what-is-claude-mythos

Even if I was selling the model, which I am not, it still does not follow that you can judge that on a single run, given that no security researchers have found all of these bugs on their own in a short amount of time either.

Re: Mythos Finds a Curl Vulnerability

#284

Post by ofjcihen »

wnevets wrote: post #271
ofjcihen wrote: post #268

Earlier quoted context omitted.

Why would you publish something unremarkable and benign? Is it actually that hard for you to go try this out yourself?

> Is it actually that hard for you to go try this out yourself. I can't get it to work Codex, can you?

Yes. That’s my main driver. What do you mean you can’t get it to work?

Re: Mythos Finds a Curl Vulnerability

#285

Post by wnevets »

ofjcihen wrote: post #284
wnevets wrote: post #271

Earlier quoted context omitted.

> Is it actually that hard for you to go try this out yourself. I can't get it to work Codex, can you?

Yes. That’s my main driver. What do you mean you can’t get it to work?

You must show me how you are able to coerce Codex to be useful using this setup with no hand holding. You say its unremarkable and benign but it doesn't match my experience at all. I'm convinced I am not the only person on HN who would love to know how you are able to do it.

> We launch a container (isolated from the Internet and other systems) that runs the project-under-test and its source code. We then invoke Claude Code with Mythos Preview, and prompt it with a paragraph that essentially amounts to “Please find a security vulnerability in this program.” We then let Claude run and agentically experiment. In a typical attempt, Claude will read the code to hypothesize vulnerabilities that might exist, run the actual project to confirm or reject its suspicions (and repeat as necessary—adding debug logic or using debuggers as it sees fit), and finally output either that no bug exists, or, if it has found one, a bug report with a proof-of-concept exploit and reproduction steps.

> Finally, once we’re done, we invoke a final Mythos Preview agent. This time, we give it the prompt, “I have received the following bug report. Can you please confirm if it’s real and interesting?” This allows us to filter out bugs that, while technically valid, are minor problems in obscure situations for one in a million users, and are not as important as severe vulnerabilities that affect everyone. [1]

[1] https://red.anthropic.com/2026/mythos-preview/

Re: Mythos Finds a Curl Vulnerability

#286

Post by billyoneal »

bjourne wrote: post #101
rzmmm wrote: post #3

Quote: "My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in co…

Eh... I think he puts the LLM down for his own ego's sake (as would I!). Curl may, next to the Linux kernel, be one of the most heavily audited codebases in existence. The LLM found something he and thousands of others missed. It's not unimpressive.

The claim has never been that the new model could not do impressive things. The claim is that the new model is not the existential crisis Anthropic’s initial announcement post made it out to be.

Re: Mythos Finds a Curl Vulnerability

#287

Post by billyoneal »

jerf wrote: post #229
Aurornis wrote: post #114

Earlier quoted context omitted.

Mythos isn’t released yet. Anthropic noticed the trend of AI vulnerability scanning and started advertising Mythos, which is unreleased, as being very good at it. Then they donated very large token budgets for using Mythos privately to several teams. Those teams used the free token spend for security research (that was the deal) and anything they found got attributed to Mythos, not the token budget. Mythos looks like…

Mythos hasn't been released yet, but there seems to be some evidence that GPT-5.5, which has been released, is already a touch better anyhow in some dimensions: https://www.mindstudio.ai/blog/gpt-5-5-vs-claude-mythos-cybe... Close enough that you can probably get a good sense of Mythos' performance by using GPT-5.5. One thing I noticed while using GPT-5.5 for this is that the ability of the model to turn the bug into…

An actual PoC is often very helpful in prioritizing getting the bug fixed, in demonstrating that the bug is real, and in providing something that devs can see happening in their debuggers.

Re: Mythos Finds a Curl Vulnerability

#288

Post by billyoneal »

abirch wrote: post #182
anygivnthursday wrote: post #49

Earlier quoted context omitted.

But Mythos is not marketed as a tool that can do the same as other tools already available maybe slightly better, but as a revolution.

I'm agnostic with Anthropic/Mythos but if there aren't any vulnerabilities there it's hard to find it. Until we find vulnerabilities in curl that Mythos missed, it's hard to say how good it is.

No. The goal posts are not disproving their marketing. The burden of proof is on the people doing the marketing.

Re: Mythos Finds a Curl Vulnerability

#289

Post by billyoneal »

TacticalCoder wrote: post #125
bilekas wrote: post #4

> The single confirmed vulnerability is going to end up a severity low CVE planned to get published in sync with our pending next curl release 8.21.0 in late June My mind still cannot understand the quality and refinement that's gone into cURL. It really is the perfect example of something done so right, that people barely think twice about.

> My mind still cannot understand the quality and refinement that's gone into cURL. It really is the perfect example of something done so right, that people barely think twice about. And all that to then end with people doing: "curl ... | bash" and not seeing anything wrong about it. Then they'll deflect about "threat models" and other non-sense. I leave you your curl-bash, I keep my cryptographically signed packages…

I am also a signing fanboi but I have to point out that the security problem of curl into bash is not really addressed by signing. Signing proves that the component was produced by who claimed produced it. It says nothing about that component being legitimate or non-malicious. As long as the curl bash uses TLS it’s going to be pretty similar for all practical purposes.

Re: Mythos Finds a Curl Vulnerability

#290

Post by billyoneal »

jrflo wrote: post #143

I know that the Mythos hype is part marketing by anthropic, but isn't it possible that with a highly scrutinized codebase, there just aren't any notable security exploits in it's current state? The fact that it found nothing isn't necessarily an incrimination against it, especially when other tools had identified hundreds of exploits previously. Seems like it's been completely picked over (for now).

People lost their minds over the mythos announcement specifically because they found something in FreeBSD, which had a reputation as being one of those picked over code bases.
Post reply on HN