Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New serious vulnerabilities spiked around release of Claude Mythos Preview

epoch.ai

Post reply on HN
Print view View original

31–40 of 82 posts

Re: New serious vulnerabilities spiked around release of Claude Mythos Preview

#31

Post by rurban »

I do maintain dozens of C/C++/Perl projects. I got massive amounts of new good vulnerability reports, more than with the latest fuzzing waves. Fuzzing is still the majority overall, but Opus dominates now. Haven't got any Mythos/Fable vuln yet. And with the help of Sonnet/DeepSeek I can finally get around and weed out all the still existing fuzzing bugs. It has nothing to do with Mythos for me, just people getting Anthropic Max accounts.

And CVE's: People actually do that now, which before they didn't. Github allowing it now, certainly does help massively. This is a good thing

Re: New serious vulnerabilities spiked around release of Claude Mythos Preview

#32

Post by wrs »

cperciva wrote: post #29
no-name-here wrote: post #19

Earlier quoted context omitted.

In pretty much every single HN post on this topic, there are a number of commenters claiming it’s false. Continued quantifiable data like this seems very important at hopefully resolving the ongoing disagreement about the facts.

I've seen plenty of people saying "Mythos isn't all that exceptional, lots of LLMs can find security vulnerabilities" -- and indeed there is some evidence for that; it sounds like Anthropic was taken somewhat by surprise at how easily a simple prompt managed to get Mythos to deliver exploits and didn't distinguish immediately between the effectiveness of Mythos and the effectiveness of the prompt. But the claim of "L…

I thought the point was not that Mythos finds more vulnerabilities, but that it can exploit them much more successfully. I thought the report showed it didn’t find much more than Opus 4.8. (Or did I misread?)

Re: New serious vulnerabilities spiked around release of Claude Mythos Preview

#33

Post by [deleted] »

guessmyname wrote: post #8
hoppp wrote: post #4

How are these reports verified to be valid? If there are too many some could be hallucinations too.

We (Project Glasswing users) follow a proof-of-concept approach. We create the exploit and verify that it behaves as the AI claims. Given our experience as security engineers (many of us with 10+ YoE) we don’t simply report every critical bug Mythos claims to have found. We verify each one carefully. At least, that’s what most of the high-visibility users in Project Glasswing are doing. There are bad apples everywher…

[deleted]

Re: New serious vulnerabilities spiked around release of Claude Mythos Preview

#34

Post by cbzbc »

nextaccountic wrote: post #11
stingraycharles wrote: post #6

Earlier quoted context omitted.

> The best case scenario for AI companies is, people receive those bug reports, look at the model that produced it and not even look at the details, just apply the fix mindlessly Do people maintaining serious software do this, though?

The problem is that serious software is drowning in AI vulnerability reports. There is not enough manpower to analyze them properly. And if you ignore the reports (like curl is doing in their 1-month vacation), malicious actors will just exploit them. At some point it's inevitable to just rubber stamp whatever is coming from AI. The actual , underlying problem is that software is buggy and current programming languag…

That gap explains much of the spike. Companies who never used any scanning tools on much of their codebase are suddenly having that gap closed.

Re: New serious vulnerabilities spiked around release of Claude Mythos Preview

#35

Post by sigmoid10 »

wrs wrote: post #32
cperciva wrote: post #29

Earlier quoted context omitted.

I've seen plenty of people saying "Mythos isn't all that exceptional, lots of LLMs can find security vulnerabilities" -- and indeed there is some evidence for that; it sounds like Anthropic was taken somewhat by surprise at how easily a simple prompt managed to get Mythos to deliver exploits and didn't distinguish immediately between the effectiveness of Mythos and the effectiveness of the prompt. But the claim of "L…

I thought the point was not that Mythos finds more vulnerabilities, but that it can exploit them much more successfully. I thought the report showed it didn’t find much more than Opus 4.8. (Or did I misread?)

If you look at public benchmarks like ExploitBench [1], then you'll see this is mostly a question of token budget. Once you give it sufficient tokens to burn, GPT 5.5 is roughly as good as Mythos when it comes to finding bugs and building exploits. With some clever auto-prompting to clear stalls, it even beats the base Mythos version. So Mythos' "magic" is not in the model, but in the harness and compute env. That's probably also why they never released it, because Anthropic already struggled heavily to make Opus available to the general public. Releasing Mythos publicly may well be technically impossible for them due to compute constraints.

[1] https://exploitbench.ai

Re: New serious vulnerabilities spiked around release of Claude Mythos Preview

#36

Post by re-thc »

nextaccountic wrote: post #11
stingraycharles wrote: post #6

Earlier quoted context omitted.

> The best case scenario for AI companies is, people receive those bug reports, look at the model that produced it and not even look at the details, just apply the fix mindlessly Do people maintaining serious software do this, though?

The problem is that serious software is drowning in AI vulnerability reports. There is not enough manpower to analyze them properly. And if you ignore the reports (like curl is doing in their 1-month vacation), malicious actors will just exploit them. At some point it's inevitable to just rubber stamp whatever is coming from AI. The actual , underlying problem is that software is buggy and current programming languag…

> At some point it's inevitable to just rubber stamp whatever is coming from AI.

To make it worse? AI and even Fable can make things +50% and then -50% in different places. You can trade 1 bug for another.

So just "rubber stamp" doesn't make it better.

Re: New serious vulnerabilities spiked around release of Claude Mythos Preview

#38

Post by zuck_torrenter »

cperciva wrote: post #17

This is hardly news? We've known for months that a flood of AI-assisted vulnerabilities was coming; I posted on Twitter in March calling 2026 the year of a million CVEs: https://x.com/i/status/2035045573116789002

[dead]

Re: New serious vulnerabilities spiked around release of Claude Mythos Preview

#39

Post by intended »

hatefulheart wrote: post #28
guessmyname wrote: post #26

Earlier quoted context omitted.

I didn’t claim to have 10+ YoE; I said that most of the people in Project Glasswing are security researchers with 10+ YoE (avg). > Its very hard to understand what you're saying with the comment Yes, fair enough. I’m simply trying to shed some light on what goes on behind the scenes without disclosing too much information to avoid breaching the NDA(s) that all Project Glasswing users have signed. There’s a lot of spe…

[flagged]

I care.

HN has always been a place where people get to learn and understand things from viewpoints and domains they don’t work in.

It seems that HN has more people who want to just build stuff, than people who have to fix security issues. Discussing security is itself a challenge, because of NDAs.

I don’t think any sane adult assumes that sweeping stuff under the rug means the problem has gone away.

Post reply on HN