Daniel Stenberg said Anthropic’s Mythos bug hunting model found only one confirmed low-severity vulnerability in cURL after scanning the project’s codebase.
In a blog post , Stenberg said the results did not support the strong marketing around the AI model. He said he saw “no evidence” that Mythos identified issues at a higher or more advanced level than existing AI code analysis tools. Stenberg described the rollout around Mythos as “an amazingly successful marketing stunt.”
According to a report by The Register , Stenberg was offered access to Anthropic’s Mythos model through the company’s Project Glasswing program, which provides selected open source projects with access through the Linux Foundation.
However, Stenberg said he never received direct access to the model. Instead, another person with access ran Mythos against cURL’s codebase and later shared the report with him.
The scan analyzed cURL’s Git repository using a recent master branch commit and identified five issues it labeled as “confirmed security vulnerabilities.”
Stenberg said he initially expected the report to contain a larger list of vulnerabilities. After reviewing the findings with the cURL security team, the group reduced the list to one confirmed vulnerability.
According to Stenberg, three of the findings were false positives linked to cURL limitations already documented in the API documentation. The fourth issue was classified as a standard bug rather than a security vulnerability.
Stenberg said the single confirmed vulnerability will receive a low-severity CVE and is expected to be published alongside cURL release 8.21.0 in late June.
He added that the flaw was not considered serious. Stenberg concluded that while Mythos may still have some value, he did not see evidence that it performed beyond the level of other modern AI security analysis tools.
📢 For the latest Tech & Telecom news, videos and analysis join ProPakistani's WhatsApp Group now!
Follow ProPakistani on Google News & scroll through your favourite content faster!
Shares
