Mythos unleashed on Opensource
Prime reacts to Daniel Stenberg's blog post "Mythos finds a curl vulnerability." Anthropic hyped Mythos as too dangerous to release; Mozilla declared "the zero days are numbered." Reality: Mythos scanned curl's 178k lines of C, reported 5 confirmed vulns, of which 4 were false positives or non-security bugs. Net result: one low- severity CVE, shipping in the next routine release. Prime's read: incremental improvement, not a security singularity — and the breathless marketing is aimed squarely at developers as the cash cow.
Background
- Stenberg's 2024 post "The I in LLM stands for intelligence" lambasted AI-generated slop PRs as a "denial of attention attack" on maintainers.
- January 2026: curl shut down its paid bug bounty over slop volume.
- April 2026: Stenberg posts "high quality chaos — no more AI slop"; AI-assisted reports finally usable.
- Curl has 573 lifetime committers, ~200 historical CVEs, layered defenses (style checks, banned-function lints, human + bot review, no force-push, no binary blobs).
Project Glasswing
- Anthropic's early-Mythos outreach to select companies / OSS projects.
- Curl was offered access; ultimately Anthropic's team ran the scan on curl's behalf. Stenberg fine with that — saved harness setup.
The actual finding
- Report claimed 5 confirmed vulnerabilities.
- After triage: 1 real low-severity CVE, 3 false positives, 1 plain bug. CVE will ship with curl 8.21.0 in late June, no out-of-band release.
- Side benefit: ~20 well-described non-security bugs with low FP rate.
- Stenberg's verdict: "the big hype around this model so far was primarily marketing." No evidence Mythos finds materially more or deeper than prior tools curl already uses.
Prime's takeaways
- Curl's prior AI tooling had already swept the easy wins, so Mythos had less to find — partial explanation for low yield.
- Classic AI confidence pattern: 5/5 high-confidence reports → 1 real.
- Defenders-vs-attackers race: better tools help both sides; no "decisive win" for defenders.
- Human expertise still load-bearing — AI raises the throughput, not the average operator's understanding.
- Developers are the cash cow: Jensen Huang's quip that a $500k engineer should be burning $250k/yr on tokens; Sam/Dario racing for trillionaire status. Marketing aimed at devs accordingly.
- Recommends OpenAI's gated security-focused model as roughly comparable, accessible alternative.