Daniel Stenberg, lead developer of cURL, reviewed results from Anthropic's Mythos model run against the cURL codebase. Although Anthropic suggested Mythos was so effective at finding security flaws that it could not be publicly released, Stenberg wrote in a Monday blog post that only one of five issues reported by Mythos turned out to be a confirmed security vulnerability. Based on this, he concluded the surrounding hype is "primarily marketing."
How Stenberg saw the results
Stenberg says he was promised access to Mythos through Anthropic's Glasswing project, which—via the Linux Foundation—gives prominent open-source projects some level of access to the model. In practice, however, he did not receive direct access. Someone with access ran Mythos on the cURL codebase and sent the resulting report to him.
He noted that he would not have had much time to experiment with different prompts or perform deeper analysis himself, so he appreciated that someone else produced the initial review.
What Mythos found in cURL
The Mythos report examined the cURL git repository based on a recent master-branch commit and flagged five items as "confirmed security vulnerabilities." After hours of review with members of the cURL security team, however, four of those findings were ruled out:
- three were false positives that pointed to previously documented API limitations;
- a fourth was judged to be a simple bug rather than a security issue.
Only a single finding remained as a confirmed vulnerability. Stenberg said this issue is low severity and is expected to be published as a CVE alongside the cURL 8.21.0 release scheduled for late June. "The bug is not going to make anyone gasp for air," he wrote.
Useful, but not revolutionary
Stenberg acknowledged that Mythos also identified several non-security bugs that the team is now fixing, and praised the quality of those descriptions and explanations. Still, he argued these results do not demonstrate Mythos to be a dramatic advance over prior AI tools.
He pointed out that over the past 8–10 months, AI-based analyzers such as AISLE, Zeropath, and OpenAI Codex Security have produced roughly two to three hundred bug fixes in cURL, many of which were real vulnerabilities and published as CVEs—likely more than a dozen such CVEs.
According to Stenberg, Mythos can do useful work, but "it's not so much better that it constitutes a major breakthrough in code analysis." He said it may be somewhat better than older models at finding certain kinds of issues, but not by a margin that transforms vulnerability discovery.
Limits of AI and the role of researchers
Stenberg observed that both older AI models and purpose-built systems like Mythos share a fundamental limitation: they can only find issues to the extent that human knowledge and patterns permit. "AI tools find the usual, known classes of bugs that we already know about. They just find new instances of them," he wrote, adding that to date no AI has reported a truly new or previously unknown class of vulnerability.
He stressed that human creativity and critical thinking remain essential in security research: AI provides stronger tools, but discovering new methods and crafting prompts still depends on human researchers.
Hope for direct access
Stenberg said he hopes to get direct access to Mythos one day to test it himself, but he was not optimistic about timing. "They promised I would get access, and it might still happen. I just don’t know when," he wrote.
Overall, Stenberg's experience suggests Mythos can be a useful tool for finding bugs and producing helpful explanations, but the intense publicity around it overstates its novelty: it appears to be an incremental improvement rather than a game-changing breakthrough in vulnerability discovery.
