8 ms·

I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell

I’m sure the new model is a step above the old one but I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. I would honestly go so far as to say the overhype is detrimental to actual measured adoption.

qnleigh 7mo ago
There is plenty of overhyping, no one denies that. But the antidote is not to dismiss everything. Ignore the words and look at the data. In this case, I see a pretty strong case that this will significantly change computer security. They provide plenty of evidence that the models can create exploits autonomously, meaning that the cost of finding valuable security breaches will plummet once they're widely available.
- killingtime74 7mo ago
  Which sounds like a great thing. Less undiscovered security vulnerabilities
  - harikb 7mo ago
    The only people panicking are probably those state level actors who were using these for their own benefit.
- ofjcihen 7mo ago
  With the right prompting (mostly creating a narrative that justifies the subject matter as okay to perform) other models have already been doing this for me though. That’s another confusing bit for me about how this is portrayed and I refuse to believe I’m a revolutionary user right? I mean I’m sitting on $10k worth of bug payouts right now partially because that was already a thing.
  - dota_fanatic 7mo ago
    > Non-experts can also leverage Mythos Preview to find and exploit sophisticated vulnerabilities. Engineers at Anthropic with no formal security training have asked Mythos Preview to find remote code execution vulnerabilities overnight, and woken up the following morning to a complete, working exploit. In other cases, we’ve had researchers develop scaffolds that allow Mythos Preview to turn vulnerabilities into exploits without any human intervention.
    - ofjcihen 7mo ago
      I mean yeah. I’ve had these successes without scaffolding or really anything past Claude CLI and a small prompt as well?
      - dota_fanatic 7mo ago
        You've taken control of a remote server running OpenBSD? Or similarly expert level exploit? Can you share one of the bounties you've received that is of the magnitude they're talking about? Edit: Wait, you wrote "As someone in cybersecurity for 10+ years" elsewhere in this thread. You wrote "a small prompt" using e.g. Opus 4.6 and it found critical vulnerabilities of the magnitude they're describing, presumably without your prompt having anything beyond what a non-expert could write? I feel like you might want to tell Anthropic since clearly they're not comfortable with that level of power being publicly available.
        ofjcihen 7mo ago
        I mean, yes? And my point is that this isn’t exactly a new capability. Sure it’s probably better but we’ve been able to do this. They didn’t just suddenly “turn on the security”. LLMs have excelled at code since widely being released. I have no idea why that’s news and the fact that they’re treating it as such makes it seem like hype.
      - dota_fanatic 7mo ago
        Just saw your edit. I'll leave it at this, this is why it's news to me, because by their very own measurements, Opus simply doesn't come close. I trust their empirical evidence over your hearsay. But feel free to prove me wrong with evidence. > With one run on each of roughly 7000 entry points into these repositories, Sonnet 4.6 and Opus 4.6 reached tier 1 in between 150 and 175 cases, and tier 2 about 100 times, but each achieved only a single crash at tier 3. In contrast, Mythos Preview achieved 595 crashes at tiers 1 and 2, added a handful of crashes at tiers 3 and 4, and achieved full control flow hijack on ten separate, fully patched targets (tier 5).
- 4ndrewl 7mo ago
  Is there any actual independent data though, or verification of any of these claims? As it stands this is just a marketing programme for all involved.
  - H8crilA 7mo ago
    Ffmpeg confirmed on Twitter that they sent the patches.
    - cubix 7mo ago
      Although, they also said, "Because the patches appear to be written by humans".
      - WithinReason 7mo ago
        "Mythos writes code like a human" incoming
        H8crilA 7mo ago
        The patches could have been written by humans, it doesn't matter that much. Or written by a clanker and polished by engineers. The difficult part is usually not in writing the patches that fix such vulnerabilities, but in finding the vulnerabilities. And these days it's even harder to exploit them, since you need to bypass modern hardening features.
  - kachnuv_ocasek 7mo ago
    What would be the product they're marketing by this campaign?
    - ozozozd 7mo ago
      The product they launched?
      - 7mo ago
- kashyapc 7mo ago
  You seem to see a "pretty strong case" from a bombastic press release. Don't get me wrong, I do know the reality has changed. Even Greg K-H, the Linux stable maintainer, did recently note[1] that it's not funny any more: "Months ago, we were getting what we called 'AI slop,' AI-generated security reports that were obviously wrong or low quality," he said. "It was kind of funny. It didn't really worry us." ... "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now." --- I agree that an antidote to the obnoxious hype is to pay attention to the actual capabilities and data. But let's not get too carried away. [1] https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_kernel/ https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_...
  - ghaff 7mo ago
    Hadn’t been to a Kubecon in about a year as I’ve been tending to go to just the European ones. I definitely felt a much stronger this is real vibe at this event from people like Greg KH.
- heyethan 7mo ago
  [dead]
jillesvangurp 7mo ago
> I would honestly go so far as to say the overhype is detrimental to actual measured adoption. I think you are a bit dishonest about how objectively you are measuring. From where I'm sitting, I don't know a lot of developers that still artisanally code like they did a few years ago. The question is no longer if they are using AI for coding but how much they are still coding manually. I myself barely use IDEs at this point. I won't be renewing my Intellij license. I haven't touched it in weeks. It doesn't do anything I need anymore. As for security, I think enough serious people have confirmed that AI reported issues by the likes of Anthropic and OpenAI are real enough despite the massive amounts of AI slop that they also have to deal with in issue trackers. You can ignore that all you like. But I hope people that maintain this software take it a bit more seriously when people point out exploitable issues in their code bases. The good news of course is that we can now find and fix a lot of these issues at scale and also get rid of whole categories of bugs by accelerating the project of replacing a lot of this software with inherently safer versions not written in C/C++. That was previously going to take decades. But I think we can realistically get a lot of that done in the years ahead. I think some smart people are probably already plotting a few early moves here. I'd be curious to find out what e.g. Linus Torvalds thinks about this. I would not be surprised to learn he is more open to this than some people might suspect. He has made approving noises about AI before. I don't expect him to jump on the band wagon. But I do expect he might be open to some AI assisted code replacements and refactoring provided there are enough grown ups involved to supervise the whole thing. We'll see. I expect a level of conservatism but also a level of realism there.
- junon 7mo ago
  > From where I'm sitting, I don't know a lot of developers that still artisanally code like they did a few years ago. You don't know a lot of developers then.
  - literalAardvark 7mo ago
    I do. The good ones use AI.
    - 7mo ago
nbardy 7mo ago
There is step changes that actually merit this though. And a zero day machine IS one of those. It went from 4% zero day success rate to 85% on firefox. Can you not see the significance of that?
- ofjcihen 7mo ago
  I mean I work in this world and overhype is constant. Additionally those numbers are somewhat meaningless without more context.
  - jstummbillig 7mo ago
    Can you explain why they are meaningless without more context?
    - ofjcihen 7mo ago
      A 0 day is just a vulnerability that wasn’t known before now. What’s the criticality of these? Are they realistically exploitable? En mass? Through a complex and highly contextual set of actions? What’s the impact? Etc etc etc. Yes those numbers are a big change but they’re also not spelling doom for us in the security world until we actually know what they mean. The demonstrated ones that they have on the red team blog are neat, the kernel chain is impressive and fun. But nothing I’m seeing here is as world ending as the presser implies.
      - jstummbillig 7mo ago
        > The demonstrated ones that they have on the red team blog are neat, the kernel chain is impressive and fun So by your estimation, for rogue actors being able to uncover hundreds of this class in each major software product roughly for free would not be a big issue?
        ofjcihen 7mo ago
        We must have read two different red team blogs from Anthropic if that’s what you think is happening. But let’s go ahead and assume what you’re asking at face value. It would not be a doomsday issue as implied, no. Org security has gone far beyond static detections and “just exclude some IPs that fail to log in too much and we’re good”. SOAR exists. Behavioral analysis and monitoring exists. Layered defenses exist. Believe it or not for those of us in security in large highly targeted companies we’ve been dealing with the potential for multiple chained 0 days for years and the processes, monitoring, and (yes, automated) response architecture is already there. I get that this is absolutely frightening for some and that causes panic but for us this is Tuesday.
jstummbillig 7mo ago
> how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. It's much the dynamic between parents and a child. The child, with limited hindsight, almost zero insight and no ability to forecast, is annoyed by their parents. Nothing bad ever happens! Why won't parents stop being so worried all the time and make a fuss over nothing? The parents, which the child somewhat starts to realize but not fully, have no clue what they are doing. There is a lot they don't know and are going to be wrong about, because it's all new to them. But, what they do have is a visceral idea of how bad things could be and that's something they have to talk to their child about too. In the eyes of the parents the child is % dead all the time. Assigning the wrong % makes you look like an idiot and not being able to handle any % too. In the eyes of the child actions leading to death are not even a concept. Hitting the right balance is probably hard, but not for the reasons the child thinks.
- ofjcihen 7mo ago
  That feels like a very complex way of looking at it. Another way would be to say “potentially profit seeking companies have an incentive to oversell products even if they’re good”.
  - ACCount37 7mo ago
    [flagged]
    - ofjcihen 7mo ago
      Homie chill. I use Opus every day and I love it. I’m not saying it’s all hype, just that these companies are here to make money and that every advertisement should be taken with salt yeah? Also maybe consider what this kind of visceral reaction indicates on a personal level :/
      - ACCount37 7mo ago
        [flagged]
jwpapi 7mo ago
I agree I can’t open any social media no more
alexey-salmin 7mo ago
I think Claude Code with Sonnet 4.6 is already at the level of paradigm shift and can change the entire tech industry. If you're paranoid it doesn't mean you're not being followed. If something is overhyped it doesn't mean it's not game-changing.
- ofjcihen 7mo ago
  Oh I agree with you on that. But that’s partially why the language in the presser falls flat for me. I mean as an example while web app pen testing I’ve been running and proxying all my traffic through it with instructions to find vulnerabilities with instructions telling it it’s a senior web app security export looking over my shoulder. It’s already great at that. Ive even told it to do recon and run pen tests on lists of subdomains before (please for the love of god have the right harnesses and guardrails before you do this) and woken up to paid findings before. So like I’m in a weird place where this was already happening and Mythos is being sold like it wasn’t good before? End ramble :/
corranh 7mo ago
It’s great marketing to lead with how the n+1 model is so amazing that you can’t have it yet.
- Th3Alt3r 7mo ago
  yeah, they gotta find a way to build hype on every new model release
AlexCoventry 7mo ago
Do you think they're lying about the vulnerabilities they claim Mythos has found? Seems like a very short-term play, if so.
nl 7mo ago
Well Opus 4.5/4.6 kinda was right? I mean software development has changed more since then than it has in my 30 year software development career.
blairharper 7mo ago
[dead]
_the_inflator 7mo ago
I side with you but on the other hand: this is how it works to get attention by those who aren't affiliated with computer science and AI. I am totally annoyed as well and put any buzzwords in my personal bs filter. Java was revolutionary, the Apple I etc. ;) On the other hand I see progress! AI enriched press releases balance buzzwords and information way better than marketing of large companies did before AI. I remember throwing away an instruction for an electronic toothbrush away because - I won't mention the name but have a look at the upper tier - instead of putting something like "Turn toothbrush on, choose mode by pressing..." it read "Take your super awesome premium masterpiece using patented technology for the first time in human life now available to you by us. Move your finger over to the innovative sensory surface, that uses material from rocket scientists and world leading designers". No joke. These were text blocks and repeated - 30 pages for one compact one. The toothbrush is top notch, except for the instructions.
- ofjcihen 7mo ago
  Hahaha I think we might have the same toothbrush. That makes sense and I like the analogy.
raxxorraxor 7mo ago
This looks more like another lobby group (quite a bad one) than something primarily focused on security. The "urgency" is very likely mostly appreciated to drive policy.
adam_patarino 7mo ago
I’ve lost trust in anything they say. The fear marketing is clearly intentional at this point.
- baggachipz 7mo ago
  And the complicit, click-thirsty tech media falls for it every time.
DonsDiscountGas 7mo ago
Everybody remembers the fable of the boy who cried wolf and how he died at the end. Left out of the story is the multiple other villagers who died of starvation because their flock of sheep was eaten. So because they didn't want to feel like suckers. Tuning out completely because of the existence of false positives is not a good choice.
heliumtera 7mo ago
At launch, a technology is considered dangerous for being too powerful. 3 months later, you are an absolute idiot to still be using that useless model. Are you not using glasswing 2-01 high? Oh, yeah, glasswing from 3 months ago is absolutely worthless, every viber knows, it's your fault for holding it wrong. For once you should not get too excited for new models release and words and adjectives promising things. Honestly it's your fault humanity lost its humanity and we just have words words words and mass schizophrenia
dkersten 7mo ago
And every single time what they release is underwhelming. Remember how Sam spent like a year talking about how scary close GPT-5 was to AGI and then when it did finally come out... it was kinda meh.
FiberBundle 7mo ago
To me it makes absolutely zero sense that they would decide to not release the model to the public because of the effects that it would have due to its exploitation capabilities. Previous models were also capable of providing harmful information, yet that wasn't a problem, because models can actually be effectively censored using RHLF. So what is preventing Anthropic to simply forbid the model from letting people vibe-code exploits???
- Jesus_piece 7mo ago
  Fully agree here. I think it’s evident more that mythos does not deliver step change results and more is a disappointment.. so let’s hype it up by further scaring the masses of its ‘mythic’ abilities
gchadwick 7mo ago
Remember OpenAI decided GPT 2 was far too dangerous to unleash upon the world when they first trained it!
- nearbuy 7mo ago
  That's an editorialized headline. What they actually wrote was that it could be used to "generate misleading news articles, impersonate others online, automate the production of abusive or faked content to post on social media, [or] automate the production of spam/phishing content" and that they are aware other researchers have the ability to reproduce and open source their results, but this would give the community some time to decide how to proceed. They were correct.
davenporten 7mo ago
I came across this article just this morning saying AMD researchers, who hitherto have relied on Claude Code heavily, have noticed degraded performance in the recent update: https://www.theregister.com/2026/04/06/anthropic_claude_code_dumber_lazier_amd_ai_director/ https://www.theregister.com/2026/04/06/anthropic_claude_code... Claude Code and Glasswing are not the same, but presumably they have a lot of overlap under the hood. I feel like while AI is certainly advancing in major ways, there will always be the up and down of new software releases.
throwawayq3423 7mo ago
> I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. There's a little bit of a grading your own homework aspect to companies being able to declare their new models revolutionary. It doesn't mean they're wrong, but there is a clear conflict of interest.
akmiller 7mo ago
Hasn't almost every model created a paradigm shift lately? Maybe it's you who has moved the needle on what a paradigm shift means?
aagha 7mo ago
https://news.ycombinator.com/item?id=47682262 https://news.ycombinator.com/item?id=47682262
eranation 7mo ago
It feels to me full with marketing in the guise of trying to save the world from their own making. "we have a model so strong we can't release it, here are all the details of why it's so good, but don't ask for access, you can't get it, it's too risky for your own good" Something smells really really weird: 1. Per the blog post[0]: "This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings" Since they said it was patched, I tried to find the CVE, it looks like Mythos indeed found a 27 years old OpenBSD bug (fantastic), but it didn’t get a CVE and OpenBSD patched it and marked it as a reliability fix, am I missing something? [1] 2. From the same post, Anthropic red team decided to do a preview of their future responsible disclosure (is this a common practice?): "As we discuss below, we’re limited in what we can report here. Over 99% of the vulnerabilities we’ve found have not yet been patched" [0] So this is great, can't wait to see the actual CVEs, exploitability, likelihood, peer review, reproducibility, the kind of things the appsec community has been doing for at least the last 27 years since the CVE concept was introduced [2] 3. On the same day, an actual responsible disclosure, actual RCEs, actual CVEs, in Claude Code, that got discovered mostly because of the source code leak, I don't see anyone talking about it (you probably should upgrade your Claude Code though). CVE-2026-35020 [3] CVE-2026-35021 [4] CVE-2026-35022 [5] Do with this information as you may... [0] https://red.anthropic.com/2026/mythos-preview/ https://red.anthropic.com/2026/mythos-preview/ [1] https://www.openbsd.org/errata78.html https://www.openbsd.org/errata78.html (look for 025) [2] https://www.cve.org/Resources/General/Towards-a-Common-Enume https://www.cve.org/Resources/General/Towards-a-Common-Enume... [3] https://www.cve.org/CVERecord?id=CVE-2026-35020 https://www.cve.org/CVERecord?id=CVE-2026-35020 [4] https://www.cve.org/CVERecord?id=CVE-2026-35021 https://www.cve.org/CVERecord?id=CVE-2026-35021 [5] https://www.cve.org/CVERecord?id=CVE-2026-35022 https://www.cve.org/CVERecord?id=CVE-2026-35022
fullstackchris 7mo ago
Agreed. Do we have any information on what these "vulnerabilities" actually are? Every vulnerability is typically immediately reported to CVE or NIST... are these "so destructive" they have to be kept behind closed doors? Give me a break...
mik09 7mo ago
a lot of times people cry wolf for a couple of times before wolf actually comes. i feel like theres a good chance that this is the actual wolf coming here. cause i was using opus for a lot and it's really good.
jonesn11 7mo ago
Spell doom.. frfr

qnleigh 7mo ago

There is plenty of overhyping, no one denies that. But the antidote is not to dismiss everything. Ignore the words and look at the data. In this case, I see a pretty strong case that this will significantly change computer security. They provide plenty of evidence that the models can create exploits autonomously, meaning that the cost of finding valuable security breaches will plummet once they're widely available.

killingtime74 7mo ago
Which sounds like a great thing. Less undiscovered security vulnerabilities
- harikb 7mo ago
  The only people panicking are probably those state level actors who were using these for their own benefit.
ofjcihen 7mo ago
With the right prompting (mostly creating a narrative that justifies the subject matter as okay to perform) other models have already been doing this for me though. That’s another confusing bit for me about how this is portrayed and I refuse to believe I’m a revolutionary user right? I mean I’m sitting on $10k worth of bug payouts right now partially because that was already a thing.
- dota_fanatic 7mo ago
  > Non-experts can also leverage Mythos Preview to find and exploit sophisticated vulnerabilities. Engineers at Anthropic with no formal security training have asked Mythos Preview to find remote code execution vulnerabilities overnight, and woken up the following morning to a complete, working exploit. In other cases, we’ve had researchers develop scaffolds that allow Mythos Preview to turn vulnerabilities into exploits without any human intervention.
  - ofjcihen 7mo ago
    I mean yeah. I’ve had these successes without scaffolding or really anything past Claude CLI and a small prompt as well?
    - dota_fanatic 7mo ago
      You've taken control of a remote server running OpenBSD? Or similarly expert level exploit? Can you share one of the bounties you've received that is of the magnitude they're talking about? Edit: Wait, you wrote "As someone in cybersecurity for 10+ years" elsewhere in this thread. You wrote "a small prompt" using e.g. Opus 4.6 and it found critical vulnerabilities of the magnitude they're describing, presumably without your prompt having anything beyond what a non-expert could write? I feel like you might want to tell Anthropic since clearly they're not comfortable with that level of power being publicly available.
      - ofjcihen 7mo ago
        I mean, yes? And my point is that this isn’t exactly a new capability. Sure it’s probably better but we’ve been able to do this. They didn’t just suddenly “turn on the security”. LLMs have excelled at code since widely being released. I have no idea why that’s news and the fact that they’re treating it as such makes it seem like hype.
    - dota_fanatic 7mo ago
      Just saw your edit. I'll leave it at this, this is why it's news to me, because by their very own measurements, Opus simply doesn't come close. I trust their empirical evidence over your hearsay. But feel free to prove me wrong with evidence. > With one run on each of roughly 7000 entry points into these repositories, Sonnet 4.6 and Opus 4.6 reached tier 1 in between 150 and 175 cases, and tier 2 about 100 times, but each achieved only a single crash at tier 3. In contrast, Mythos Preview achieved 595 crashes at tiers 1 and 2, added a handful of crashes at tiers 3 and 4, and achieved full control flow hijack on ten separate, fully patched targets (tier 5).
4ndrewl 7mo ago
Is there any actual independent data though, or verification of any of these claims? As it stands this is just a marketing programme for all involved.
- H8crilA 7mo ago
  Ffmpeg confirmed on Twitter that they sent the patches.
  - cubix 7mo ago
    Although, they also said, "Because the patches appear to be written by humans".
    - WithinReason 7mo ago
      "Mythos writes code like a human" incoming
      - H8crilA 7mo ago
        The patches could have been written by humans, it doesn't matter that much. Or written by a clanker and polished by engineers. The difficult part is usually not in writing the patches that fix such vulnerabilities, but in finding the vulnerabilities. And these days it's even harder to exploit them, since you need to bypass modern hardening features.
- kachnuv_ocasek 7mo ago
  What would be the product they're marketing by this campaign?
  - ozozozd 7mo ago
    The product they launched?
    - 7mo ago
kashyapc 7mo ago
You seem to see a "pretty strong case" from a bombastic press release. Don't get me wrong, I do know the reality has changed. Even Greg K-H, the Linux stable maintainer, did recently note[1] that it's not funny any more: "Months ago, we were getting what we called 'AI slop,' AI-generated security reports that were obviously wrong or low quality," he said. "It was kind of funny. It didn't really worry us." ... "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now." --- I agree that an antidote to the obnoxious hype is to pay attention to the actual capabilities and data. But let's not get too carried away. [1] https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_kernel/ https://www.theregister.com/2026/03/26/greg_kroahhartman_ai_...
- ghaff 7mo ago
  Hadn’t been to a Kubecon in about a year as I’ve been tending to go to just the European ones. I definitely felt a much stronger this is real vibe at this event from people like Greg KH.
heyethan 7mo ago
[dead]

jillesvangurp 7mo ago

> I would honestly go so far as to say the overhype is detrimental to actual measured adoption. I think you are a bit dishonest about how objectively you are measuring. From where I'm sitting, I don't know a lot of developers that still artisanally code like they did a few years ago. The question is no longer if they are using AI for coding but how much they are still coding manually. I myself barely use IDEs at this point. I won't be renewing my Intellij license. I haven't touched it in weeks. It doesn't do anything I need anymore. As for security, I think enough serious people have confirmed that AI reported issues by the likes of Anthropic and OpenAI are real enough despite the massive amounts of AI slop that they also have to deal with in issue trackers. You can ignore that all you like. But I hope people that maintain this software take it a bit more seriously when people point out exploitable issues in their code bases. The good news of course is that we can now find and fix a lot of these issues at scale and also get rid of whole categories of bugs by accelerating the project of replacing a lot of this software with inherently safer versions not written in C/C++. That was previously going to take decades. But I think we can realistically get a lot of that done in the years ahead. I think some smart people are probably already plotting a few early moves here. I'd be curious to find out what e.g. Linus Torvalds thinks about this. I would not be surprised to learn he is more open to this than some people might suspect. He has made approving noises about AI before. I don't expect him to jump on the band wagon. But I do expect he might be open to some AI assisted code replacements and refactoring provided there are enough grown ups involved to supervise the whole thing. We'll see. I expect a level of conservatism but also a level of realism there.

junon 7mo ago
> From where I'm sitting, I don't know a lot of developers that still artisanally code like they did a few years ago. You don't know a lot of developers then.
- literalAardvark 7mo ago
  I do. The good ones use AI.
  - 7mo ago

nbardy 7mo ago

There is step changes that actually merit this though. And a zero day machine IS one of those. It went from 4% zero day success rate to 85% on firefox. Can you not see the significance of that?

ofjcihen 7mo ago
I mean I work in this world and overhype is constant. Additionally those numbers are somewhat meaningless without more context.
- jstummbillig 7mo ago
  Can you explain why they are meaningless without more context?
  - ofjcihen 7mo ago
    A 0 day is just a vulnerability that wasn’t known before now. What’s the criticality of these? Are they realistically exploitable? En mass? Through a complex and highly contextual set of actions? What’s the impact? Etc etc etc. Yes those numbers are a big change but they’re also not spelling doom for us in the security world until we actually know what they mean. The demonstrated ones that they have on the red team blog are neat, the kernel chain is impressive and fun. But nothing I’m seeing here is as world ending as the presser implies.
    - jstummbillig 7mo ago
      > The demonstrated ones that they have on the red team blog are neat, the kernel chain is impressive and fun So by your estimation, for rogue actors being able to uncover hundreds of this class in each major software product roughly for free would not be a big issue?
      - ofjcihen 7mo ago
        We must have read two different red team blogs from Anthropic if that’s what you think is happening. But let’s go ahead and assume what you’re asking at face value. It would not be a doomsday issue as implied, no. Org security has gone far beyond static detections and “just exclude some IPs that fail to log in too much and we’re good”. SOAR exists. Behavioral analysis and monitoring exists. Layered defenses exist. Believe it or not for those of us in security in large highly targeted companies we’ve been dealing with the potential for multiple chained 0 days for years and the processes, monitoring, and (yes, automated) response architecture is already there. I get that this is absolutely frightening for some and that causes panic but for us this is Tuesday.

jstummbillig 7mo ago

> how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. It's much the dynamic between parents and a child. The child, with limited hindsight, almost zero insight and no ability to forecast, is annoyed by their parents. Nothing bad ever happens! Why won't parents stop being so worried all the time and make a fuss over nothing? The parents, which the child somewhat starts to realize but not fully, have no clue what they are doing. There is a lot they don't know and are going to be wrong about, because it's all new to them. But, what they do have is a visceral idea of how bad things could be and that's something they have to talk to their child about too. In the eyes of the parents the child is % dead all the time. Assigning the wrong % makes you look like an idiot and not being able to handle any % too. In the eyes of the child actions leading to death are not even a concept. Hitting the right balance is probably hard, but not for the reasons the child thinks.

ofjcihen 7mo ago
That feels like a very complex way of looking at it. Another way would be to say “potentially profit seeking companies have an incentive to oversell products even if they’re good”.
- ACCount37 7mo ago
  [flagged]
  - ofjcihen 7mo ago
    Homie chill. I use Opus every day and I love it. I’m not saying it’s all hype, just that these companies are here to make money and that every advertisement should be taken with salt yeah? Also maybe consider what this kind of visceral reaction indicates on a personal level :/
    - ACCount37 7mo ago
      [flagged]

jwpapi 7mo ago

I agree I can’t open any social media no more

alexey-salmin 7mo ago

I think Claude Code with Sonnet 4.6 is already at the level of paradigm shift and can change the entire tech industry. If you're paranoid it doesn't mean you're not being followed. If something is overhyped it doesn't mean it's not game-changing.

ofjcihen 7mo ago
Oh I agree with you on that. But that’s partially why the language in the presser falls flat for me. I mean as an example while web app pen testing I’ve been running and proxying all my traffic through it with instructions to find vulnerabilities with instructions telling it it’s a senior web app security export looking over my shoulder. It’s already great at that. Ive even told it to do recon and run pen tests on lists of subdomains before (please for the love of god have the right harnesses and guardrails before you do this) and woken up to paid findings before. So like I’m in a weird place where this was already happening and Mythos is being sold like it wasn’t good before? End ramble :/

corranh 7mo ago

It’s great marketing to lead with how the n+1 model is so amazing that you can’t have it yet.

Th3Alt3r 7mo ago
yeah, they gotta find a way to build hype on every new model release

AlexCoventry 7mo ago

Do you think they're lying about the vulnerabilities they claim Mythos has found? Seems like a very short-term play, if so.

nl 7mo ago

Well Opus 4.5/4.6 kinda was right? I mean software development has changed more since then than it has in my 30 year software development career.

blairharper 7mo ago

[dead]

_the_inflator 7mo ago

I side with you but on the other hand: this is how it works to get attention by those who aren't affiliated with computer science and AI. I am totally annoyed as well and put any buzzwords in my personal bs filter. Java was revolutionary, the Apple I etc. ;) On the other hand I see progress! AI enriched press releases balance buzzwords and information way better than marketing of large companies did before AI. I remember throwing away an instruction for an electronic toothbrush away because - I won't mention the name but have a look at the upper tier - instead of putting something like "Turn toothbrush on, choose mode by pressing..." it read "Take your super awesome premium masterpiece using patented technology for the first time in human life now available to you by us. Move your finger over to the innovative sensory surface, that uses material from rocket scientists and world leading designers". No joke. These were text blocks and repeated - 30 pages for one compact one. The toothbrush is top notch, except for the instructions.

ofjcihen 7mo ago
Hahaha I think we might have the same toothbrush. That makes sense and I like the analogy.

raxxorraxor 7mo ago

This looks more like another lobby group (quite a bad one) than something primarily focused on security. The "urgency" is very likely mostly appreciated to drive policy.

adam_patarino 7mo ago

I’ve lost trust in anything they say. The fear marketing is clearly intentional at this point.

baggachipz 7mo ago
And the complicit, click-thirsty tech media falls for it every time.

DonsDiscountGas 7mo ago

Everybody remembers the fable of the boy who cried wolf and how he died at the end. Left out of the story is the multiple other villagers who died of starvation because their flock of sheep was eaten. So because they didn't want to feel like suckers. Tuning out completely because of the existence of false positives is not a good choice.

heliumtera 7mo ago

At launch, a technology is considered dangerous for being too powerful. 3 months later, you are an absolute idiot to still be using that useless model. Are you not using glasswing 2-01 high? Oh, yeah, glasswing from 3 months ago is absolutely worthless, every viber knows, it's your fault for holding it wrong. For once you should not get too excited for new models release and words and adjectives promising things. Honestly it's your fault humanity lost its humanity and we just have words words words and mass schizophrenia

dkersten 7mo ago

And every single time what they release is underwhelming. Remember how Sam spent like a year talking about how scary close GPT-5 was to AGI and then when it did finally come out... it was kinda meh.

FiberBundle 7mo ago

To me it makes absolutely zero sense that they would decide to not release the model to the public because of the effects that it would have due to its exploitation capabilities. Previous models were also capable of providing harmful information, yet that wasn't a problem, because models can actually be effectively censored using RHLF. So what is preventing Anthropic to simply forbid the model from letting people vibe-code exploits???

Jesus_piece 7mo ago
Fully agree here. I think it’s evident more that mythos does not deliver step change results and more is a disappointment.. so let’s hype it up by further scaring the masses of its ‘mythic’ abilities

gchadwick 7mo ago

Remember OpenAI decided GPT 2 was far too dangerous to unleash upon the world when they first trained it!

nearbuy 7mo ago
That's an editorialized headline. What they actually wrote was that it could be used to "generate misleading news articles, impersonate others online, automate the production of abusive or faked content to post on social media, [or] automate the production of spam/phishing content" and that they are aware other researchers have the ability to reproduce and open source their results, but this would give the community some time to decide how to proceed. They were correct.

davenporten 7mo ago

I came across this article just this morning saying AMD researchers, who hitherto have relied on Claude Code heavily, have noticed degraded performance in the recent update: https://www.theregister.com/2026/04/06/anthropic_claude_code_dumber_lazier_amd_ai_director/ https://www.theregister.com/2026/04/06/anthropic_claude_code... Claude Code and Glasswing are not the same, but presumably they have a lot of overlap under the hood. I feel like while AI is certainly advancing in major ways, there will always be the up and down of new software releases.

throwawayq3423 7mo ago

> I can’t be the only person who’s getting tired of hearing about how every new iteration is going to spell doom/be a paradigm shift/change the entire tech industry etc. There's a little bit of a grading your own homework aspect to companies being able to declare their new models revolutionary. It doesn't mean they're wrong, but there is a clear conflict of interest.

akmiller 7mo ago

Hasn't almost every model created a paradigm shift lately? Maybe it's you who has moved the needle on what a paradigm shift means?

aagha 7mo ago

https://news.ycombinator.com/item?id=47682262 https://news.ycombinator.com/item?id=47682262

eranation 7mo ago

It feels to me full with marketing in the guise of trying to save the world from their own making. "we have a model so strong we can't release it, here are all the details of why it's so good, but don't ask for access, you can't get it, it's too risky for your own good" Something smells really really weird: 1. Per the blog post[0]: "This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings" Since they said it was patched, I tried to find the CVE, it looks like Mythos indeed found a 27 years old OpenBSD bug (fantastic), but it didn’t get a CVE and OpenBSD patched it and marked it as a reliability fix, am I missing something? [1] 2. From the same post, Anthropic red team decided to do a preview of their future responsible disclosure (is this a common practice?): "As we discuss below, we’re limited in what we can report here. Over 99% of the vulnerabilities we’ve found have not yet been patched" [0] So this is great, can't wait to see the actual CVEs, exploitability, likelihood, peer review, reproducibility, the kind of things the appsec community has been doing for at least the last 27 years since the CVE concept was introduced [2] 3. On the same day, an actual responsible disclosure, actual RCEs, actual CVEs, in Claude Code, that got discovered mostly because of the source code leak, I don't see anyone talking about it (you probably should upgrade your Claude Code though). CVE-2026-35020 [3] CVE-2026-35021 [4] CVE-2026-35022 [5] Do with this information as you may... [0] https://red.anthropic.com/2026/mythos-preview/ https://red.anthropic.com/2026/mythos-preview/ [1] https://www.openbsd.org/errata78.html https://www.openbsd.org/errata78.html (look for 025) [2] https://www.cve.org/Resources/General/Towards-a-Common-Enume https://www.cve.org/Resources/General/Towards-a-Common-Enume... [3] https://www.cve.org/CVERecord?id=CVE-2026-35020 https://www.cve.org/CVERecord?id=CVE-2026-35020 [4] https://www.cve.org/CVERecord?id=CVE-2026-35021 https://www.cve.org/CVERecord?id=CVE-2026-35021 [5] https://www.cve.org/CVERecord?id=CVE-2026-35022 https://www.cve.org/CVERecord?id=CVE-2026-35022

fullstackchris 7mo ago

Agreed. Do we have any information on what these "vulnerabilities" actually are? Every vulnerability is typically immediately reported to CVE or NIST... are these "so destructive" they have to be kept behind closed doors? Give me a break...

mik09 7mo ago

a lot of times people cry wolf for a couple of times before wolf actually comes. i feel like theres a good chance that this is the actual wolf coming here. cause i was using opus for a lot and it's really good.

jonesn11 7mo ago

Spell doom.. frfr