10 ms·

Quote: "My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evid

• greendude29 5mo ago
  I'd go out and say the marketing is not subtle. The hype and fanboys/girls are so in line with the marketing that any level of skepticism is seen a an act of defection, but if you look at the words, hyperbole and volume that is used, there is nothing subtle about it. It's almost Trump-esque - "this model will change everything forever; we are doomed; we are saved; we will all be fired; we will all be rich", etc
  • xantronix 5mo ago
    That's a pretty good encapsulation of the parallels between the political and the technological: One necessarily thrives upon the other and are inextricable. This moment is a culmination of all the disenfranchisement the bodypolitik have suffered, looking for any possible means of escape or elevation. AI and Trumpism, for their own respective cohorts, are salvation, on offer by different frontmen but ultimately in service of the same system. They need the hype to pay off way more than we do. So many of us who still write code directly stand to lose nothing of our capabilities if the marketing claims cannot hold water.
  • ehnto 5mo ago
    I seem to be totally outside the hype bubble, but I have to suspect there is a lot of imagineering and wild extrapolations in the elss technical hype bubbles. I am curious but no enough to go looking.
    • tonyedgecombe 5mo ago
      >I seem to be totally outside the hype bubble I'm surprised you say that because it is all over Hacker News. Every single post is co-opted into promoting AI. Try finding a submission with fifty points or more than doesn't have AI or LLM's mentioned somewhere in the comments.
      • zen928 5mo ago
        Feel free to retire from the field if you grow tired of seeing its latest developments.
        • tonyedgecombe 5mo ago
          I already have. That’s not really the point though. I have no doubt AI is useful, I just don’t want to have it shoved in my face every five minutes.
      • ehnto 5mo ago
        That's a good point, I guess I see the Hacker News hype a bit more realistically then maybe I should. HN has definitely changed in the sense that I rarely see interesting technology or achievements hit the front page, that aren't AI related. It feels like AI has taken all the oxygen from the room.
• coldtea 5mo ago
  >It's a good reminder for us all that the competition in this space is rough and lots of more or less subtle marketing is involved. About as subtle as a personal injury lawyer's billboard
  • te_chris 5mo ago
    A thankfully American reference
    • Exoristos 5mo ago
      Can you expand on this? Do you mean in contrast to the European AI milieu?
      • te_chris 5mo ago
        No, the personal injury lawyer billboards.
        • llbbdd 5mo ago
          In the UK of course it would be "personal injury barrister"
          • te_chris 5mo ago
            I’ve never seen a billboard for it here - lived here 11 years.
  • steve1977 5mo ago
    Better Call Dario
• vidarh 5mo ago
  It may well be that the hype was primarily marketing. The other alternative is that Curl is simply secure enough that there was far less to find than in other projects.
  • teiferer 5mo ago
    Given how much money is on the line, it would be gross negligence if anything came publicly out of the CEO's mouth or is otherwise published by the company that's not marketing.
    • red75prime 5mo ago
      The question is whether they need to massage the results for them to be marketable.
      • zeroCalories 5mo ago
        Sometimes you gotta let people know how awesome you are. The real question is if you're misrepresenting yourself(all marketing, no substance).
  • shakna 5mo ago
    Daniel found 30 CVEs in Curl, this year. I would not say that there is nothing to find, here. Just that it takes an actual expert.
    • bcjdjsndon 5mo ago
      [flagged]
    • vidarh 5mo ago
      I did not suggest there was nothing to find. But is also very different to count all CVE's found and reported (there are less than 30 total for 2025 and 2026 per [1]) by anyone and everyone vs. what was found in a short time by someone prompting a model. [1] https://curl.se/docs/security.html https://curl.se/docs/security.html
• h1fra 5mo ago
  They might be biased by the fact that curl is significantly more secure than the average software
  • toraway 5mo ago
    I've seen this suggested a few times in this thread but it seems like it's exactly backwards. Wouldn't that make it a better to distinguish whether Mythos is uniquely super powerful vs an incremental improvement from Opus etc that are routinely used as the basis for bug reports/fixes in cURL? If Mythos found a hundred new show stopper bugs then it would have meant Opus missed them and therefore closer to a "step change". Otherwise it implies the difference in capability isn't nearly that stark. Mythos finding 100 low-hanging bugs in a less scrutinized/hardened project on the wouldn't be as useful signal to answer that.
• jansan 5mo ago
  Mythos marketing really leans into that "too powerful to be legal" vibe, much like how PS2s were allegedly banned from North Korea because their chips were basically missile-grade.
• therealpygon 5mo ago
  Anthropic using marketing to convince people their models are more advanced, better built, or that AI is a threat that needs to be regulated because only they have the answer? I’m shocked. More seriously, so far I haven’t seen much indication that Mythos is more than Opus with a security focused code analysis harness. That said, the fact it can find these bugs in an automated fashion is the more important takeaway outside of the hype. I’m curious what the error rate is on the detections, because none of that means much if it is wrong 90% of the time and we are only hearing about the examples that are useful marketing.
  • johnbarron 5mo ago
    >> Anthropic using marketing to convince people their models are more advanced, better built, or that AI is a threat that needs to be regulated because only they have the answer? I’m shocked. I remember when OpenAI was saying GPT-2 was too dangerous to release.
    • 2ndorderthought 5mo ago
      "it can almost like write 2 paragraphs!" "It might be conscious" "this is basically AGI, we had to fire someone who spilled the beans"
      • etiam 5mo ago
        I always thought he was fired for making crackpot statements to the press in reference to his professional capacity, and thus creating bad PR and embarrassing spectacle for his employer. Seems like legitimate reasons to me.
        • ZeroGravitas 5mo ago
          An interesting question now is whether he had standard mental health issues, or if he was an early example of AI psychosis or whatever we call people who are falling in love with their AI chatbots because they tell them how smart they are.
• bigcat12345678 5mo ago
  My guess: Marketing is not intentional. Evidences: 10 years ago, when I interviewed Baidu AI with Andrew Ng and Dario, Dario is the kind of person is pure-hearted to the point being ideological. Given Dario's successful career so far, that essence has gradually grown into a conviction, and surrounded by a purposely built team which amplifies his ideology. Humans are very convenient creature, a rare few small fraction of them are no doubt the master of convenience: they morph their mental manifold without a hint of contradiction in their own mental mechanisms.
  • OtherShrezzing 5mo ago
    I'm not sure if that distinction is important, since what you've described less charitably synonymous with the phrase "Dario is delusional, and has surrounded himself with yes-men, so outlandish marketing gets published as a side effect". Whether the person doing the marketing was sincere about it or not is immaterial, since marketing is experienced almost entirely by the people consuming it, and not the people communicating it. What matters is if the audience is sincerely concerned by the message, and it's transparently the case that they were sincerely concerned by it.
  • teiferer 5mo ago
    > Marketing is not intentional. That's an odd definition of "intentional". Evolution has filtered for people with certain views and the marketing has just emerged from their actions. ... So? A deadly virus (naturally occurring one let's say) wasn't created intentionally. Evolution selected for it. It's still bad and kills people. Doesn't make it nice because of lack of intention.
    • SpicyLemonZest 5mo ago
      I think that's a reasonable analysis, but it's very different than the one that's usually implied by "marketing". Most people I see talking about Dario and his "marketing" go on to express confusion or frustration on why he would decide to message this way, ignoring what I (and perhaps you?) consider to be the obvious answer that he believes it's true.
  • 5mo ago
• aaron695 5mo ago
  [dead]
• thombles 5mo ago
  Curl simply isn't a good data point. It's one of the most picked-over codebases in existence with extensive security testing practices. All the researchers using not-quite-Mythos models have had plenty of time to report bugs up to this point. Daniel may be right that Mythos hasn't been a game changer for curl but the preconditions are different for virtually any other codebase. Perhaps the real marketing here is his own modesty about curl's maturity.
  • 20k 5mo ago
    We see this exact hypetrain every time a new model is released. Mythos simply hasn't lived up to the "we're all gunna die from the flood of vulnerabilities" hype even slightly. Its slightly better than previous models by all accounts, cool stuff I've seen literally near word-for-word this exact chain of events multiple times previously
  • GuB-42 5mo ago
    To me, it is a very good data point. Curl uses all sorts of tools, including AI tools to find bugs. These tools, according to the article found hundreds of bugs including a dozen CVE. Mythos found one vulnerability. It means the Mythos is just another tool, not the revolution it claims to be. It is common that when a new tool is introduced that a bunch of bugs are found, with diminishing returns. Mythos finding one vulnerability is consistent to what I would expect for a major update to an existing tool, which Mythos is over existing LLM-based solutions.
    • thombles 5mo ago
      The question is how many security vulnerabilities are actually left in the code after all the recent AI attention. Either Mythos is a nothingburger, or it's substantially more powerful but there's nothing left to do. Even a large amount of C can be correct eventually. Curl has the _potential_ to become a good data point maybe 6-12 months from now - if researchers and new tools find many more vulnerabilities then Mythos is proved to be hype. If they don't, then maybe Mythos is overkill for today's curl and its capabilities are better deployed elsewhere (like Firefox, apparently).
• deleted 5mo ago
  [deleted]
• 63stack 5mo ago
  I'm pretty sure mythos is just a new unreleased version of Opus + marketing + a different system prompt.
  • eskibars 5mo ago
    I suspect so as well. I've been running my own security scanning software (disclaimer: now starting a company @ zeroquarry.com) for this, and from what I've seen there's a huge value in prompts + adversarial LLM review. Without adversarial review, you get garbage (as this blog points out: 4/5 basically are nonsense) and with a good prompt, you can use almost any "near frontier" model from my experience as long as the prompt helps with the guardrails or the model doesn't protect in such a strict way
    • dboreham 5mo ago
      It's almost as if management was a useful function in organizations ;)
• bjourne 5mo ago
  Eh... I think he puts the LLM down for his own ego's sake (as would I!). Curl may, next to the Linux kernel, be one of the most heavily audited codebases in existence. The LLM found something he and thousands of others missed. It's not unimpressive.
  • billyoneal 5mo ago
    The claim has never been that the new model could not do impressive things. The claim is that the new model is not the existential crisis Anthropic’s initial announcement post made it out to be.
• JeremyNT 5mo ago
  This is roughly what I was assuming but of course the big caveat here is that they were already using the existing LLM driven tooling on an extensively audited codebase. So while anthropic's marketing may be hype there just wasn't much left to find, a point he makes in the blog post. Whether it's a big step forward for other kinds of projects is difficult to tell, but this highlights that everybody should be using AI code review tools to audit their existing code today, and not everybody is.
  • embedding-shape 5mo ago
    None of those other LLM tooling made the claims they're too dangerous to be released and used though, unlike Anthropic did with Mythos. What it highlights, is that Mythos doesn't seem so much better than other LLM driven tooling at finding security issues, which was the strongest claim Anthropic made in the first place.
    • hug 5mo ago
      Actually, OpenAI made a similar claim about one of their GPT models a while ago… Funnily enough that was while Dario Amodei was their research director.
      • neuronexmachina 5mo ago
        If you're referring to gpt-2 in 2019, that primarily about concerns with it being used by spammers and fake content generators. In retrospect, that was a totally valid concern.
        • jimmySixDOF 5mo ago
          They had a reddit with GPT2 back and forth I have to say I got suckered into a conversation before I figured it out -- it was definitely the OG Moltbook of non sequiturs
    • iterateoften 5mo ago
      People love defending Anthropics shortcomings… “Mythos isn’t supposed to be that good at security, because actually Anthropic was referring more about running llms than mythos specifically” “The opus model is worse because they have no compute because they are training mythos. The degraded performance is justified!” “All the bugs in Claude code is just because the models are so good they are just looping and are shipping fast” Constantly see people crawl out of the woodwork to defend a trillion dollars company overhyping every press release it gives
• smusamashah 5mo ago
  He also said this [1] a few weeks ago about AI PRs. > Over the last few months, we have stopped getting AI slop security reports in the #curl project. They're gone. > Instead we get an ever-increasing amount of really good security reports, almost all done with the help of AI. > They're submitted in a never-before seen frequency and put us under serious load. > I hear similar witness reports from fellow maintainers in many other Open Source projects. > Lots of these good reports are deemed "just bugs" and things we deem not having security properties. [1]: https://www.linkedin.com/posts/danielstenberg_hackerone-share-7446667043380076545-RX9b/ https://www.linkedin.com/posts/danielstenberg_hackerone-shar...
• cvwright 5mo ago
  Even that press release never claimed that Mythos was better than Opus at finding bugs. They claim the huge advance is in exploiting the bugs.
• wnevets 5mo ago
  I commented this in another post but I'm going to repeat it because I believe its important for this discussion. > The worrying part about Mythos isn't the fact that it can find bugs. The worrying part is Mythos being able to find them on its own across entire code base as vast as Firefox then write exploits for what its found with a very basic prompt. > The skill required to find then create zero days is quickly approaching the floor.
  • colechristensen 5mo ago
    Opus can find bugs on its own in large codebases just fine with minimal prompting. The great exaggeration is that this is a new capability.
    • wnevets 5mo ago
      > Opus can find bugs on its own in large codebases just fine with minimal prompting. and then it write the exploits automatically for you?
      • colechristensen 5mo ago
        Yes
        • wnevets 5mo ago
          Can you send me that link?
          • colechristensen 5mo ago
            What link? I've done it myself.
            • wnevets 5mo ago
              You've pointed codex to the entire source code of firefox and simply prompted it to find bugs and then had it write the exploits for you? Why haven't you published this? That would sink all of the the claude code hype.
• khlapz 5mo ago
  Yes, the governments fall for it for the time being: https://www.politico.eu/article/anthropic-hacking-technology-exposes-eu-ai-office-struggles/ https://www.politico.eu/article/anthropic-hacking-technology... This is an advertising masterpiece: UK gets first access, the EU is jealous and wants it, too. Thousands of bureaucrats and parasites make money in the process writing (probably using AI) whitepapers and sitting in meetings. The open source authors whose works are being scanned make nothing. We know how the money flows. Another unrelated example is that ex MI6 director Sir John Sawers is a Palantir consultant and sells out the UK to Palantir.
• orblivion 5mo ago
  Is Mozilla marketing on Anthropic's behalf? As part of our continued collaboration with Anthropic, we had the opportunity to apply an early version of Claude Mythos Preview to Firefox. This week’s release of Firefox 150 includes fixes for 271 vulnerabilities identified during this initial evaluation. As these capabilities reach the hands of more defenders, many other teams are now experiencing the same vertigo we did when the findings first came into focus. For a hardened target, just one such bug would have been red-alert in 2025, and so many at once makes you stop to wonder whether it’s even possible to keep up. https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vulnerabilities/ https://blog.mozilla.org/en/privacy-security/ai-security-zer...
  • dboreham 5mo ago
    I think it's more the cost to find a vulnerability that has significantly reduced, not the possibility that the vulnerability could have been found. But that cost mattered tremendously because someone has to fund the effort to find the bugs. This economics also applies to attackers.
    • orblivion 5mo ago
      Is Firefox less invested in this than Curl? I mean there must be some explanation for this.
      • spenczar5 5mo ago
        It's in the first sentence of your quote: "our continued collaboration with Anthropic" Read this as: "we get discounts, rate limit increases, a direct line to responsible product managers; in exchange we participate in friendly marketing." It's extremely common in this line of business - typical of database vendors, software tool companies, etc.
        • orblivion 5mo ago
          This is more in response to my original post, but okay interesting point. (When I said "invested" here I meant invested in finding security flaws.)
• alwillis 5mo ago
  > My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I think the results say more about the great job the curl team has done maintaining their codebase. This doesn’t mean Anthropic's Project Glasswing is a marketing stunt. Logically, it doesn’t make sense: when they announced Mythos Preview, Anthropic couldn’t meet customer demand; they didn’t have enough compute to go around. So they decide to hype an unreleased product to drive even more demand? All that would do is piss off their existing customers who already experiencing rationing and frequent outages. Many forums were already flooded with "I cancelled Claude Code" as it was. On the contrary, it would be incredibly irresponsible and unethical for such a young company with billions of dollars of other people’s money invested in them. Because the Mozilla team used Mythos and found 271 vulnerabilities [1], does that mean they're in on the so-called "marketing stunt"? Of course, if Anthropic had released Mythos to the public and bad actors used it to hack a large number of banks, hospitals, government agencies, etc. in a matter of days, the HN crowd would be all over them for acting irresponsibly and criticizing them for not knowing better. [1]: "Behind the Scenes Hardening Firefox with Claude Mythos Preview" — https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ https://hacks.mozilla.org/2026/05/behind-the-scenes-hardenin...
  • asltp_ 5mo ago
    Other AI tools have found 300 bugs and this new sentient T1000 only found one. Stenberg himself found 30 this year. Mozilla is the current poster child but 271 in such a large codebase with thousands of user options, most of them being TOCTOU isn't that much. Sorry. TOCTOU can happen in any language when people are simply exhausted by the sheer volume of case explosions. There is a third option: Anthropic could simply have reported the issue without mentioning the new model at all. But they don't, since they want to sell to governments and military and the artificial scarcity just provides a veneer of exclusivity that their clients will appreciate.
• red75prime 5mo ago
  I have an impression that he expects something like the famous move 37 of AlphaGo, while it could be that the situation is like in chess where superhuman engines validated human findings.
• hislaziness 5mo ago
  Am I missing something here. Not finding a major bug/vulnerability just means that maybe the code is really good, not that the model is not what is claimed?