41–50 of 82 posts
…are we really drawing conclusions on this starting at April? When it was released in June?
Mythos is from April, it was just limited to a small number of organizations.
Earlier quoted context omitted.
We (Project Glasswing users) follow a proof-of-concept approach. We create the exploit and verify that it behaves as the AI claims. Given our experience as security engineers (many of us with 10+ YoE) we don’t simply report every critical bug Mythos claims to have found. We verify each one carefully. At least, that’s what most of the high-visibility users in Project Glasswing are doing. There are bad apples everywher…
Its very hard to understand what you're saying with the comment - like you have 10+ years of experience and you verify each bug because you know Mythos can provide fake positives. But other teams (which also should have people equivalent to your skill and experience level) suck at it so much that CVP level workers are having to spend time on their fake reports. Then you say Anthropic should stop theater. Then you say…
This is hardly news? We've known for months that a flood of AI-assisted vulnerabilities was coming; I posted on Twitter in March calling 2026 the year of a million CVEs: https://x.com/i/status/2035045573116789002
In pretty much every single HN post on this topic, there are a number of commenters claiming it’s false. Continued quantifiable data like this seems very important at hopefully resolving the ongoing disagreement about the facts.
The end result is both that there are more critical CVE and that there aren’t.
Earlier quoted context omitted.
Mythos is from April, it was just limited to a small number of organizations.
It was announced in April, but it was leaked in March (CMS bug) at which point external partners were already using it, and the most common rumored date for training competition is 2026-02-07 (I think Feb is likely, but that specific date is just rumor).
https://www-cdn.anthropic.com/7624816413e9b4d2e3ba620c5a5e09... (pg. 13)
So basically there are two plausible explanations: 1. Someone with early access to Mythos leaked it to the bad guys. 2. Cybercriminals are getting enough mileage out of alternatives to Mythos to create exploits far more quickly, even though they don't have access to Mythos. My own guess is that it's a combination of #2 plus vibe-coding degrading software quality at multiple layers, open the door to sophisticated expl…
Disclosure of a vulnerability doesnt mean a bad guy found it.
It's almost like... Finding bugs is a good thing.
How are these reports verified to be valid? If there are too many some could be hallucinations too.
We (Project Glasswing users) follow a proof-of-concept approach. We create the exploit and verify that it behaves as the AI claims. Given our experience as security engineers (many of us with 10+ YoE) we don’t simply report every critical bug Mythos claims to have found. We verify each one carefully. At least, that’s what most of the high-visibility users in Project Glasswing are doing. There are bad apples everywher…
Earlier quoted context omitted.
We (Project Glasswing users) follow a proof-of-concept approach. We create the exploit and verify that it behaves as the AI claims. Given our experience as security engineers (many of us with 10+ YoE) we don’t simply report every critical bug Mythos claims to have found. We verify each one carefully. At least, that’s what most of the high-visibility users in Project Glasswing are doing. There are bad apples everywher…
Its very hard to understand what you're saying with the comment - like you have 10+ years of experience and you verify each bug because you know Mythos can provide fake positives. But other teams (which also should have people equivalent to your skill and experience level) suck at it so much that CVP level workers are having to spend time on their fake reports. Then you say Anthropic should stop theater. Then you say…
Wait, you guys had a RCE in Claude Code for nearly a year and didn't even release a disclosure about it and secretly patched it and swept it under the rug?
Well... It's okay, I still trust you."