11 ms·

Project Glasswing: An Initial Update

• mmsc 5mo ago
  Aisle has hundreds of CVEs with publicly available models: https://aisle.com/wall-of-fame https://aisle.com/wall-of-fame
• bhupendraTale05 5mo ago
  [flagged]
• OsrsNeedsf2P 5mo ago
  The vulnerabilities found continues to impress, and make legacy media, Twitter and Youtube go nuts. But we still have no data to prove this wasn't doable with the same initiative backed by Opus 4.7, and there is no GA for Mythos access.
  • bobbycastorama 5mo ago
    I've seen a blog post by a security researcher saying that he was able to find the same vulnerabilities (for Firefox IIRC) with a ~30B params LLM... So yeah, huge marketing as always.
    • wiwiwq 5mo ago
      To me it’s clear what’s going on. The American firms are focused on marketing now to convince people to not even consider open sourced models / open weight models as they are inferior (that’s what they want you to believe).
      • rhubarbtree 5mo ago
        IPO is coming is what is going on
        • wiwiwq 5mo ago
          That’s implicit in my post. If people actually believe the narrative then the bankers will over price Anthropic and get away with it.
          • 0gs 5mo ago
            what's weirdest to me (and i agree with you) is that it could ALSO be true that a highly competently managed, highly capitalized closed source and weights model training on tons of real-world data non-stop COULD stay ahead of open weights models, and that lead COULD grow. now, how competent (much less merciless) the frontier-blazing U.S. corporations will be able to be long-term ... i suspect they are right to be nervous and highly focused on optics, regardless of the truth :)
    • Brystephor 5mo ago
      Did the security researcher point the LLM at the blob of information and say "Find vulnerabilities" or was the LLM told to "determine if vulnerability X is present in this blob"? Confirmation of suspected vulnerabilities is a different problem from finding vulnerabilities.
    • krisbolton 5mo ago
      This is different though right? He found one (? we don't know who you're referring to - post sources for a higher quality discussion) vulnerability, he already knew it was there, etc. Anthropic didn't claim no other model can find vulnerabilities, nor that it's impossible with smaller models. They're claiming Mythos is a step-change in ability for end-to-end vulnerability discover and exploit creation. And that other frontier models are close behind.
    • simonw 5mo ago
      You mean this one? https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jag... That's the one that says: > We took the specific vulnerabilities Anthropic showcases in their announcement, isolated the relevant code, and ran them through small, cheap, open-weights models. Those models recovered much of the same analysis.
      • dansquizsoft 5mo ago
        Sounds like he applied exactly the same methodology then!
    • nikcub 5mo ago
      Finding the neeedle is easier when you remove the haystack Or providing a map with a direction There is a long history of high-value private vulns being rediscovered from scant details
  • boston_clone 5mo ago
    you would likely be quite interested in the more quantitative writeup from a real research team ! it’s linked about midway in to the article - similar functionally can be reached, yes, but not always and never with fewer tokens than what mythos requires. https://xbow.com/blog/mythos-offensive-security-xbow-evaluation https://xbow.com/blog/mythos-offensive-security-xbow-evaluat...
    • OsrsNeedsf2P 5mo ago
      Ok this is actually a pretty good article and justifies the step function marketing in security they talked about
  • pertymcpert 5mo ago
    > Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview—over ten times more than they found in Firefox 148 with Claude Opus 4.6 4.6 but close.
    • OsrsNeedsf2P 5mo ago
      Right, but were they using the same methodology and harness? I'm skeptical that they're doing something with the harness - i.e. with Mythos, they pass each file in one at a time, whereas on 4.6 they let Claude Code run loose to find bugs. This would have a larger impact difference than the model itself.
      • mpyne 5mo ago
        Yes, the harness they used actually existed and was in use beforehand, it wasn't developed for testing with Mythos.
      • ZrArm 5mo ago
        From Mozilla post [1]: "...After fixing the initial set of issues that Anthropic sent to us in February, we built our own harness atop our existing fuzzing infrastructure. We began with small-scale experiments prompting the harness to look for sandbox escapes with Claude Opus 4.6. Even with this model, we identified an impressive amount of previously-unknown vulnerabilities which required complex reasoning over multiprocess browser engine code..." So yeah, Anthropic and Mozilla likely compare "Amount of bugs found by Opus 4.6 during early experiments" vs "Amount of bugs found by Mythos during large-scale codebase scanning". [1] https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ https://hacks.mozilla.org/2026/05/behind-the-scenes-hardenin...
  • parker-3461 5mo ago
    Makes me wonder if Anthropic is really having issues with allocating compute (see recent deals with xAI and SpaceX). From available benchmarks, it seems like similar results should be possible with GPT 5.5 Pro or Opus 4.7 (with specific cybersecurity trained models).
    • wiwiwq 5mo ago
      Who knows but from a valuation stand point it’s better to signal that demand is higher than existing capacity..
    • smoe 5mo ago
      At least according to this, GPT-5.5 Cyber is on par with Mythic, as the only two models that were able to finish their 32-step corporate network attack simulation. https://www.aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5-5-cyber-capabilities https://www.aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5...
  • energy123 5mo ago
    . Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview—over ten times more than they found in Firefox 148 with Claude Opus 4.6;
    • applfanboysbgon 5mo ago
      Did they allocate the same number of tokens to looking with Claude 4.6? Or did they find more because they looked more, owing to a special initative by Anthropic?
    • deleted 5mo ago
      [deleted]
    • properbrew 5mo ago
      > over ten times more than they found in Firefox 148 with Claude Opus 4.6 And how much with Opus 4.7? 5x?
    • kllrnohj 5mo ago
      No, not really. Mythos found 3 CVEs, not 271. https://www.flyingpenguin.com/mythos-mystery-in-mozilla-numbers-how-22-vulns-became-271-or-maybe-3-in-april/ https://www.flyingpenguin.com/mythos-mystery-in-mozilla-numb...
      • moyix 5mo ago
        I think you're confusing CVEs and vulnerabilities here? Mozilla (per their longstanding practice) grouped multiple vulnerabilities found internally under a small number of CVEs.
      • simonw 5mo ago
        The Mozilla team responded to that argument here: https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/ https://hacks.mozilla.org/2026/05/behind-the-scenes-hardenin... - in the FAQ.
  • enlightenedfool 5mo ago
    Is this the God model that no one else can build? Unbelievable.
  • krisbolton 5mo ago
    There is independent research out there on frontier model security capability. AI Security Institute (UK) put out their paper comparing Mythos to other frontier models in early April. They've been tracking frontier model security capability since early 2023, so it's a decent dataset. https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-previews-cyber-capabilities https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos...
  • arjie 5mo ago
    The era where you could reputably believe things published by anyone on this front is over. If you want this information, you’re going to have to attempt it yourself with the Opus API. It is entirely possible that any released model access will be heavily guardrailed against hacking attempts and Mythos is just an unrailed model. It is entirely possible that Mythos is a different architecture or size. We can’t know from the outside. There is also a pretty big risk that anyone who is not you would leak the answer to the test. We are close to n=1 epistemics here. You’re going to have to do the research yourself.
    • MallocVoidstar 5mo ago
      > It is entirely possible that any released model access will be heavily guardrailed against hacking attempts Yes, Anthropic have said they made Opus 4.7 worse at this on purpose. > It is entirely possible that Mythos is a different architecture or size It has 5x the token pricing of Opus 4.7, so it's probably larger.
  • ospray 5mo ago
    This report is far more positive with a far lower false positive rate than I was expecting based on reports from the curl team and a few others. I guess I have just been hearing about the ten percent misses. Can anyone not employed by Anthropic who has used it vouch that it is equal to general human testers and do you need xbow to make it that way.
  • deleted 5mo ago
    [deleted]
  • kirtivr 5mo ago
    Training for Mythos finished in February, 2026 while training for Opus 4.7 finished around that same time. If I understand correctly, Opus 4.7 was launched as nerfed Mythos with some improvements from 4.6. Anthropic launches major bumps (like 4.6 to 4.7) every 4 - 5 months. So by all accounts, Mythos should be released by July. The problem reduces to: How quickly can competing models surpass Opus 4.7 and start taking over Anthropic's market share?
• amusingimpala75 5mo ago
  [edit: TFA addresses this, though I still find crazy 90% accuracy overall vs 20% accuracy for curl] Is this suspected vulns or actual vulns? If I recall correctly, it produced 5 for curl but only 1 was legit
  • extr 5mo ago
    Did you RTFA?
  • RamRodification 5mo ago
    This is marketing. So probably suspected. Or somewhere in between.
  • Smaug123 5mo ago
    > So far, Mythos Preview has found what it estimates are 6,202 high- or critical-severity vulnerabilities in these projects (out of 23,019 in total, including those it estimates as medium- or low-severity). > 1,752 of those high- or critical-rated vulnerabilities have now been carefully assessed by one of six independent security research firms, or in a small number of cases by ourselves. Of these, 90.6% (1,587) have proved to be valid true positives, and 62.4% (1,094) were confirmed as either high- or critical-severity. That means that even if Mythos Preview finds no further vulnerabilities, at our current post-triage true-positive rates, it’s on track to have surfaced nearly 3,900 high- or critical-severity vulnerabilities in open-source code
  • rbranson 5mo ago
    I don't know why you're getting downvoted. This is exactly what was reported by curl's creator under the section "Five findings became one": https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/ https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-v...
    • wiwiwq 5mo ago
      [flagged]
    • Smaug123 5mo ago
• InsideOutSanta 5mo ago
  I wonder if it coincidentally becomes safe to release when compute capacity bought from SpaceX will provide enough headroom to let a lot more people run it.
  • lukeschlather 5mo ago
    It seems like Mythos is often (or typically?) costing $20k per vulnerability, so I don't think there will be enough compute capacity in the world any time soon to let a lot more people use it the way Glasswing is using it. That is not to say I think they are exaggerating its capabilities. That $20k is presumably the rough cost of renting the GPUs, and there are not enough GPUs in the world.
    • why_only_15 5mo ago
      what's the origin of your $20k/vuln estimate?
      • gck1 5mo ago
        It's the same as the origin of "Codex/Opus subscription usage is heavily subsidized" - the sales departments equipped with AI agents with the prompt: "use anonymous accounts on the internet to make it easy for me to sell it at $price".
    • InsideOutSanta 5mo ago
      I'm not sure if current pricing correlates with actual compute cost.
  • b65e8bee43c2ed0 5mo ago
    stop noticing things, chud.
  • sigmar 5mo ago
    "available to qualifying customers’ security teams on request." Seems they're already expanding access.
  • 5mo ago
• 0xAstro 5mo ago
  I had a fun day today where I had deepseek-v4-flash subagents work out patch for dirty frag for systems with AF_ALG disabled and nscd turned on, to gain root access. The original published exploit wasn't working but the patched one worked like a charm. I am still a believer that a 100 subagents with good-enough intelligence can get same results as mythos, I am ready for this opinion to be shattered when I eventually try mythos and I believe others here must have tried mythos out too.
  • lukeschlather 5mo ago
    That's probably true, but when you're talking about 100 subagents you're talking about something that costs $100/hour to run, and Mythos takes $20k to find a vulnerability, so the question isn't "can dumber models conceivably do this?" It's, if running inference with Mythos to find an exploit costs 5000 GPU-hours per exploit, how many GPU-hours does it cost with a dumber model?
• orangebread 5mo ago
  BOOO RELEASE THE MODEL ALREADY GAWD
  • guluarte 5mo ago
    after IPO
• mdeeks 5mo ago
  You can get a taste of this today yourself with Codex Security. I turned it on just as an experiment and in less than a week it has now become essential to all of us. I was shocked how accurate it is, how many security issues it found in existing code, how it continually finds them as we commit, and how NO ONE is immune from making these mistakes. I'd say it is about 90% accurate for us. Often even the "Low" findings lead us to dig and realize it is actually exploitable. Everyone makes these mistakes, from the most junior to the most senior. They are just a class of bugs after all. I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. Highly recommend you get something enabled for your own repos ASAP
  • 0xAstro 5mo ago
    I would recommend you to try out the setup with gpt-5.5-cyber as the orchestrator and deepseek-v4-flash or some other fast cheap model as its workers. Getting pretty good results using this setup.
  • Version467 5mo ago
    I’ve had the same experience. The ui is a little unclear about this, because it says you have 5 scans, but 1 scan is just the continuous monitoring of the default branch of a repo. The high impact findings have almost all been bang on for me. I was especially surprised by the high-quality documentation it produces as well as how narrow the proposed fixes are. I’m used to codex producing quite a but more code than it needs to, but the security model proposed fixes that are frequently <10 loc, targeting exactly the correct place. It’s really quite good. I’m assuming it’ll be pretty expensive once out of beta, but as a business I’d be jumping on this.
  • winstonwinston 5mo ago
    > I expect tools like this to be a regular part of the development lifecycle from here on. We code with AI, we review with AI, we search for vulns with AI. Even if it isn't perfect, it is easily worth the cost IMHO. So, how is that supposed to work? Claude Code generates security bugs, then Claude Security finds them, then Claude Code generate fix, spend tokens, profit?
• vincefutr23 5mo ago
  Mythos couldn’t find the “tens thousand” typo in this post?
• ares623 5mo ago
  > good lord what is happening in there?! > that's just thousands of vulnerabilities being discovered by our trillion parameter model > thousands of vulnerabilities and trillions of parameters?! At current energy prices, in this economic climate, isolated entirely within your datacenter? > yes > may we see it? > no
  • pixl97 5mo ago
    I built a missile that can blow you up. >ya right. Here's a demonstration of it blowing something up. >can I have one. No.
• mlazos 5mo ago
  I believe them to some degree but this trend of posting stuff when it can’t be verified actually needs to end. I’m so tired of this bs marketing.
• rsync 5mo ago
  I asked in a different thread: Do we have a sense that projects like OpenBSD/OpenSSH, FreeBSD, ISC[1] and Apache were included in the "blessed" initial participants in Project Glasswing ? Or is it big name tech companies, banks and fashionable languages and package managers ? [1] Bind, DHCP
  • ls612 5mo ago
    “Oi, you got a loicense to make secure software there?” I joke but that is the world we are moving towards. I don’t think many on HN have thought through the second and third order implications.
  • icedchai 5mo ago
    Probably? FreeBSD has had a large increase in security advisories the past couple months. More in the last two months than all of 2025 combined.
    • rsync 5mo ago
      Those advisories all came from outside sources, most notably calif.io. It's not clear to me that FreeBSD found any of them internally ...
      • adamckay 5mo ago
        Calif.io have access to Mythos Preview which they've used to find a macOS kernel memory corruption exploit on Apple M5: https://blog.calif.io/p/first-public-kernel-memory-corruption https://blog.calif.io/p/first-public-kernel-memory-corruptio... It's probably the right approach to onboard a few independent security companies and task them with reviewing multiple OSS projects than it is to onboard each project individually.
• chopete3 5mo ago
  >> Next, we will work with critical partners—including US and allied governments—to expand Project Glasswing to additional partners. That means, they intend to make a load of money before a general release. It is a good strategy.
• nikcub 5mo ago
  There has been a lot of cynicism around mythos, that it's just the usual public models without guardrails, etc. etc. but this: > 1,752 of those high- or critical-rated vulnerabilities have now been carefully assessed by one of six independent security research firms, or in a small number of cases by ourselves. Of these, 90.6% (1,587) have proved to be valid true positives, and 62.4% (1,094) were confirmed as either high- or critical-severity. for anybody who has applied opus, codex or oss models for vuln scanning - the true positive rate and discovery volume are a clear step change[0]. The ~50 partners in Glasswing have largely all previously run harnesses with other models and many of them have come out and said - essentially - "ye, wow" Question now is what a second and third phases of access looks like - deciding which class of systems to secure. Routers, firewalls, SaaS, ERP systems, factory controllers, SCADA systems, zero-trust VPN gateways, telecoms gear and networks, medical devices - there's just so much to do This is why I believe mythos will remain private for the foreseeable future. There's such a large surface that needs to be secured and so much to triage, fix, deploy. That may suit Anthropic as private models can't be distilled. There's also a runaway effect of model improvement from the discovery, triage and fix data. This is likely already the most potent corpus of curated offensive data ever assembled and will only get better. I don't see how Chinese companies are given access soon, or ever. We're likely going to see a world soon of CISA mandated audits, and where to buy a mythos-proof VPN gateway or home router - you'll have to buy American[1]. [0] vs ~30% or so in regular audit tools [1] or allied
  • gck1 5mo ago
    > This is why I believe mythos will remain private for the foreseeable future. There's such a large surface that needs to be secured and so much to triage, fix, deploy. sigh I remember the GPT-2 days - when it was the first time OpenAI restricted access to the models citing "humanity is not ready for it". The model was good at writing poetry or something. Since then, I don't remember a single model announcement from OAI/ANT that didn't use similar wording. The so-called leak of model announcement was marketing, it being dangerous is marketing, the world not being ready for it is marketing. And yes, the ones that were given access to saying "oh wow", believe or not, is also marketing. It's all marketing. You can get the same results from any of the top-5/10 models that are generally available already. Mythos is Anthropic's way to sell the new idea, because the previous one has democratized.
• giancarlostoro 5mo ago
  > Since then, we and our approximately 50 partners have used Claude Mythos Preview to find more than ten thousand high- or critical-severity vulnerabilities across the most systemically important software in the world. Progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it’s limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities found by AI. I guess they forgot to scan Visual Studio Code plugins and their endless npm dependencies.
  • pixl97 5mo ago
    I mean that's really a different issue.
• antirez 5mo ago
  I have the feeling posts like that should be 1/4 the size, at max. At this point I don't care if it is AI-slop or human-slop: they are surprisingly alike. Information must be more dense, each sentence must carry some truth.
• jimmar 5mo ago
  People predict that in 50 years, no human will be driving a car, and people will be shocked that we let humans drive cars manually. Coding may be the same. So many vulnerabilities in code written by very competent programmers. Manually building large, complex systems without major bugs or security vulnerabilities seems to be a nearly impossible challenge.
  • morpheos137 5mo ago
    there is little evidence for this prediction.
    • cubefox 5mo ago
      The rapid progress in the last few years in this regard is pretty strong evidence in my opinion.
      • morpheos137 5mo ago
        https://news.ycombinator.com/item?id=48225426 https://news.ycombinator.com/item?id=48225426 there is a difference between a stunt and a viable product. diverless cars and agi are the fusion of Silicon Valley.
        • cubefox 5mo ago
          Unlike fusion, driverless cars are already a reality, there are just have a few kinks to work out. LLMs are also pretty close to AGI already. 50 years are more than enough to figure it out.
    • sp527 5mo ago
      Oh there's plenty of evidence. Because a lot of these people have been committing to repos in public for over a decade. Wouldn't take much to show the world just how fallible human coders really are.
    • scotty79 5mo ago
      What evidence would you expect to see if that was the case?
• mixologic 5mo ago
  Right now the only codebase I care about them fixing vulnerabilities in are the 3800 repositories that got stolen from GitHub. "Vulnerabilities in the software that makes the internet" is honestly lower priority than "The platform that the software that makes the internet uses to make releases" If buyers of those internal repos find ways to break into GitHub such that they can cut software releases, or poison github actions from a distance, then we're all in a very ugly mess. Don't forget that in those 3800 repos is likely also npmjs.org itself.
• bevekspldnw 5mo ago
  How much of this is RL’ing a good coding model on every CVE ever?
  • sometimelurker 5mo ago
    most it this comes from the pretrain imo. just scale + some RL = mythos
• kalashvasaniya 5mo ago
  this is INSANEEE
• ayeeeeeeeeee 5mo ago
  It would be informative to publish not only vulnerability numbers, but also vulnerability type statistics (as available here for example: https://cvedb.github.io/years.html https://cvedb.github.io/years.html), such that programmers can understand which types of exploits popular systems and languages commonly allow, and thereby encourage fundamental changes to fix or transition away from them.
• mikmoila 5mo ago
  Code contains deviations from assumed behaviour, and some behaviours might manifest themselves as failures. Some failures might be exploitable by attackers.
• demorro 5mo ago
  If you're not already applying static analysis and linters to your codebase (and I know many of you aren't), ask yourself why you would bother to apply an expensive LLM tool? Not to say these things won't catch vulnerabilities static tools cannot, I think they can, it's just we already have the capability to automatically catch a large surface area of common vulns, and have chosen not to, often for expense reasons. If you're a team that does already apply several layers of analysis and linting, and wants to add this on top, all power to you.
  • sobellian 5mo ago
    Static analysis often shows many false positives. A more intelligent tool can help not to waste limited engineering time.
    • seanmcdirmid 5mo ago
      False positives are noise, but if the tool is filtering out its own noise via AI, it might work. Or you could take a high false positive/low false negative tool and instead of bothering humans with its noisy output, have AI investigate and evaluate if found issues are false positives or not.
    • mbonnet 4mo ago
      This is why you should have several of them checking against the same rulesets and cross-check them to reduce chasing of false positives.
  • redsocksfan45 5mo ago
    [dead]
  • SkyPuncher 5mo ago
    > If you're not already applying static analysis and linters to your codebase Because most issues are in business logic that static analyzers aren't going to catch.
    • 5mo ago
• vb-8448 5mo ago
  The report on findings is very interesting: 1451 acknowledged findings out of 23k candidates(~6%, not high but neither low). But I didn't find the most important information (or maybe I missed it): how much did it cost to find 1451 security bugs?
  • gpugreg 5mo ago
    We can at least put an upper limit on it. From https://www.anthropic.com/glasswing https://www.anthropic.com/glasswing Claude Mythos Preview will be available to participants at $25/$125 per million input/output tokens ... Anthropic is committing up to $100M in usage credits for Mythos Preview Although I'd expect reduced prices for cached tokens, which is not mentioned on their website at this point in time.
• sandeepkd 5mo ago
  > For instance, Cloudflare has found 2,000 bugs (400 of which are high- or critical-severity) across their critical-path systems, with a false positive rate that Cloudflare’s team considers better than human testers. > For example, at one of our Glasswing partner banks, Mythos Preview helped to detect and prevent a fraudulent $1.5 million wire transfer after a threat actor compromised a customer’s email account and made spoof phone calls. For some reason I am not able to relate to the concreteness of either of these. First half of the page was occupied with a image, not sure if it was relevant in any ways other than setting up security scare. The size of code base, number of tokens, $ involved seem to be out of scope of the update for some reason. Personally I am getting skeptical about all these optics at this point, just some money printing scheme at high level.
• spullara 5mo ago
  I'm going to code myself up a new minivan.
• piker 5mo ago
  We have been working with the consumer-grade frontier models to develop what we call "lexploits" in legaltech, and they are insanely good at finding bugs across integrated pipelines. They're also surprisingly good at mitigating them! Security vulnerabilities are one thing, but in legal we offer up a concept of "knowledge security" which goes to protecting the fidelity of the agent's legal context. Software bugs seem much more tractable because they're managed by software engineers, as opposed to the pipeline "vulnerabilities" we're finding. We wrote a little about one vector here where legal documents aren't quite what they seem: https://tritium.legal/blog/noroboto https://tritium.legal/blog/noroboto No doubt there are many such knowledge domains exposed today. These are more concerning because they're understaffed and managed by non-technical people for the most part. No Mythos required.
• Amekedl 5mo ago
  I don't buy it. A lot of stuff this finds is also just simply wrong, benignly reported as true, despite upper/lower layers in the code burying the possibility of a vulnerability actually being exploited. It's a performance/security trade-off too, it always has been. Additional checks and other measures do in fact need to be performed for security purposes. Great marketing as always, but the rose-tinted view many have seems vicariously misplaced.
  • solenoid0937 5mo ago
    In the article they describe how all the vulns are actually exploitable end to end and >1000 have been independently verified as critical. These aren't unreachable vulns.
    • Amekedl 5mo ago
      Where is the link to the advisories then? :/
      • skybrian 5mo ago
        As the article explains, they mostly haven't been disclosed, because they're not fixed. They're giving people 90 days, or 45 after a patch is made.
        • gck1 5mo ago
          > haven't been disclosed, because they're not fixed. That's convinient. But wait, don't they have this amazing AI that can fix all the issues itself with a single /goal command? What's the holdup?
          • solenoid0937 5mo ago
            You should really read the article, every question asked so far in this thread has been very clearly answered. I miss the days when HN would RTFA.
• cpard 5mo ago
  My understanding so far is that that Mythos (and any model in general) can produce candidate reasoning but you really need a system around that reasoning that is capable of producing auditable security findings. So, success is coming not just from the model but also from the harnesses they built around it. The Cloudflare post was more detailed on that front and I wish the rest would share more about it. The Cisco spec is interesting too, it pretty much describes an architecture of a harness: https://github.com/CiscoDevNet/foundry-security-spec https://github.com/CiscoDevNet/foundry-security-spec
• dmix 5mo ago
  I wonder if Apple took part in the project
  • guessmyname 5mo ago
    Yes, we did. I am the engineer leading Project Glasswing efforts at Apple.
    • erwald 5mo ago
      What are your general, vibes-based impressions of Mythos so far?
• ZrArm 5mo ago
  > After one month, most partners have each found hundreds of critical- or high-severity vulnerabilities in their software. And at the moment we have reports from like around 5(?) companies. Btw, Palo Alto Networks has found only 26 vulnerabilities [1]. I'm interested what those partners are and why they have such big amount of vulnerabilities. > For instance, Cloudflare has found 2,000 bugs (400 of which are high- or critical-severity) across their critical-path systems, with a false positive rate that Cloudflare’s team considers better than human testers. Yet decided not to share that number. I wonder why. > Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview—over ten times more than they found in Firefox 148 with Claude Opus 4.6; Mozilla tested Opus 4.6 in a very limited setting (i.e. without proper harness and integration into their workflow; likely without large-scale codebase scanning). It's an incorrect comparison. > The latest Palo Alto Networks release included over five times as many patches as usual. Yeah, it's better to say "five times as many..." rather than "26 bugs". Btw, they also used GPT-5.5 and Opus 4.7, so the contribution from Mythos there is unclear. > Microsoft has reported that the number of new patches they’ll release will “continue trending larger for some time.” And Oracle is finding and fixing vulnerabilities across its products and cloud multiple times faster than before. Both Oracle and Microsoft are talking about "AI and cybersecurity" in general, not about Mythos. > For the last few months, Anthropic has used Mythos Preview to scan more than 1,000 open-source projects, which collectively underpin much of the internet—and much of our own infrastructure. > So far, Mythos Preview has found what it estimates are 6,202 high- or critical-severity vulnerabilities in these projects (out of 23,019 in total, including those it estimates as medium- or low-severity). So, ~6 high- and critical- severity bugs per open-source project v.s. hundreds of high- and critical- severity bugs per partner projects. It looks like the math ain't mathing. > One example of an open-source vulnerability that Mythos Preview detected was in wolfSSL, an open-source cryptography library that’s known for its security and is used by billions of devices worldwide. Mythos Preview constructed an exploit that would let an attacker forge certificates that would (for instance) allow them to host a fake website for a bank or email provider. The website would look perfectly legitimate to an end user, despite being controlled by the attacker. We’ll release our full technical analysis of this now-patched vulnerability (assigned CVE-2026-5194) in the coming weeks. Of course, they didn't say that Mythos found only 8 bugs in wolfSSL vs 22 CVE fixed in wolfSSL 5.9.1. Overall, it feels like yet another marketing stunt. [1] https://www.paloaltonetworks.com/blog/2026/05/defenders-guide-frontier-ai-impact-cybersecurity-may-2026-update/ https://www.paloaltonetworks.com/blog/2026/05/defenders-guid...
• 0xbadcafebee 5mo ago
  Benefit of AI: it works fast Drawback of AI: it works fast
• mukmuk 5mo ago
  I’m not sure how to reconcile anthropic’s update / some of the exuberant comments here with recent feedback like the following from curl maintainer Daniel Steinberg: “I see no evidence that this setup [Mythos] finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.” https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/ https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-v...
  • skybrian 5mo ago
    Different people can have different experiences without contradiction. Maybe the curl source code was pretty clean to begin with?
    • dreambigwrkhard 5mo ago
      imo curl is quite well maintained. there are a lot of sloppy projects out there and tools like this shows whos been swimming with their pants down. not saying any project with vulnerabilities are sloppy but when costs of finding bugs and vulnerabilities decrease significantly, they will get exposed with enough time and tokens ($)
  • mayneack 5mo ago
    Daniel has been posting for months (years?) about how much scrutiny he gets from security researchers and various automated tools. I wouldn't expect curl to be the average case for mythos.
    • 3kahg 5mo ago
      It is the opposite. Security people focus on curl, sudo because they are code bases that contained a lot of features and unused code from the 1990s. They don't focus on projects where they find nothing. They certainly don't advertise when they find nothing. Getting a lot of scrutiny is not the recommendation that it appears to be. What is the new standard? Projects that never have bugs are deemed to be suspect because they "have not been scrutinized" (they have, but null results never go public)? So Mythos only finding one issue after other tools have found 300 this year is embarrassing. Mythos was supposed to be better and novel.
• guidedlight 5mo ago
  > The bottleneck in fixing bugs like these is the human capacity to triage, report, and design and deploy patches for them. Finding them in the first place has become vastly more straightforward with Mythos Preview. This has always been the bottleneck. Automated tools love to flag vulnerabilities, but almost all are false positives. These need to be triaged and evaluated by humans. This is okay. I’d rather close a false positive after a careful review than miss it altogether. I don’t think it’s appropriate for calling out humans as a bottleneck. They are an essential part of the process, I’m sure Mythos will also become a catalyst in the process.
  • tptacek 5mo ago
    It is definitely not the case that human remediation was the bottleneck for most vulnerability eradication 10 years ago. Proving out vulnerabilities was much harder than resolving them.
• felixgallo 5mo ago
  I worry that cybersecurity as target is all fine and good, but it’s looking for your keys under the streetlight. We are all familiar with computers. The problem is likely to be humans, especially in automated programmatic manipulation. The risk is that the next level of AI is going to make Fox News and other mass manipulation efforts look like kindergarten.
• smnplk 5mo ago
  I wonder how many minivans per second can ClaudeCode generate.
• amazingamazing 5mo ago
  Is there a single source separating the harness from the model here? I would love to see a controlled experiment.
• 2001zhaozhao 5mo ago
  > Next, we will work with critical partners—including US and allied governments—to expand Project Glasswing to additional partners. And in the near future, once we’ve developed the far stronger safeguards we need, we look forward to making Mythos-class models available through a general release. I wonder how long "near future" is in Anthropic time. I think they have incentives to delay the release of Mythos as long as possible both to save compute and delay distillation by rival labs. Regardless, what they have been doing with Glasswing is very cool. It's clear that the world has been spared from a massive security nightmare that would have happened in any alternative timeline where the model is publicly released with weak safeguards.
  • fc417fc802 5mo ago
    IMO the talk about safeguards is utter nonsense. The model will either find vulnerabilities for you or it won't. If it will then you can broadly use the findings as you see fit. As I see it the primary issue is giving time for the ecosystem to adapt. Once models of a given level of capability have been applied to the majority of the common software in daily use it becomes reasonably safe to release such models publicly regardless of how they are used.
• jxmesth 5mo ago
  Does anyone know how we can get access to this? We're a financial institution, pretty well known locally but not internationally. Can we request access directly or maybe via bedrock/azure?
  • fragmede 5mo ago
    Not from Anthropic, but OpenAI's Codex Security is. https://developers.openai.com/codex/security/setup https://developers.openai.com/codex/security/setup
• dundunUp 5mo ago
  go
• antegugga 5mo ago
  [dead]
• firesteelrain 5mo ago
  How is using Mythos different than existing static analysis, dynamic analysis, fuzzing, or DAST tooling?
  • nullbio 5mo ago
    Mythos is likely a harness around those things.
  • dyauspitr 5mo ago
    Stop with this nonsense. At the most basic level, it’s different because you just point it at a thing and it does everything else.
    • firesteelrain 5mo ago
      How is it nonsense? We already have these tools for years and magically Mythos comes around and makes old new again.
      • dyauspitr 4mo ago
        A guy working with those tools for 6 months might find some disparate vulnerabilities. You don’t see value in writing a prompt and having everything done for you in an evening? It’s not just that either, it chains various vulnerabilities, crafts an attack to exploit it and then verifies its real. You don’t see any value in this over having some guy plod through it for months? Also security is hard, most devs won’t find anything.
        • firesteelrain 4mo ago
          That sounds like marketing. Security tooling already automates scanning and exploit chaining. The hard part is context, accuracy, prioritization, and avoiding garbage results.
• jedisct1 5mo ago
  You can get a taste of this today yourself with Swival /audit command and the security scanner is going to get even closer soon: https://medium.com/@swival/ai-vulnerability-scanning-needs-an-attacker-story-136cc79ba74a https://medium.com/@swival/ai-vulnerability-scanning-needs-a...
• ErenayDev 5mo ago
  I was made (2 months ago) a script that finds bugs in a github repo. I tested it with claude opus 4.1 and without reasoning and it resulted with high hallucinations. e.g. : "current latest next.js version is v15. v16 doesnt shipped yet. this project fails". i added context7 mcp but hallucaniton rate decreased only a small bit. if anyone wants to test it with other models, here is the link: https://github.com/ErenayDev/instantbugs https://github.com/ErenayDev/instantbugs
• ilaksh 5mo ago
  What percentage of these are variations of the good old fashioned buffer overflow that would be impossible with Rust?
• fortzi 5mo ago
  > Progress on software security used to be limited by how quickly we could find new vulnerabilities And so was malicious vulnerability research.
  • cold_harbor 5mo ago
    the asymmetry stays the same though — defenders must find everything, attackers need one. LLMs accelerate both sides equally but that gap doesnt close
    • fortzi 5mo ago
      [dead]
• xinayder 5mo ago
  The math doesn't add up. They say they found more than 20k vulnerabilities, then it decreases to 1700 high or critical, then this number becomes 175 (when Claude didn't reassess the CVE severity) and over 500 later on. Then they say they confirmed 800 vulnerabilities... what happened to the 20k figure? Plus, they also mention they check if fixes are available for the bugs they found. What are the chances they are re-reporting old bugs just to inflate their numbers? Bugs that were already fixed? And how can we be sure their reassessment is not artifically increasing the severity of the CVEs found just to create FUD and sell their product?
• 4ndrewl 5mo ago
  Is there a reason why they appear to conflate vulnerabilities and bugs? It's not clear where they are defining their terms, eg "After one month, most partners have each found hundreds of critical- or high-severity vulnerabilities in their software. Collectively, they’ve found more than ten thousand. Several have told us that their rate of bug-finding has increased by more than a factor of ten. For instance, Cloudflare has found 2,000 bugs (400 of which are high- or critical-severity) across their critical-path systems, with a false positive rate that Cloudflare’s team considers better than human testers." (emphasis mine)
  • ch_fr 5mo ago
    I wholeheartedly believe it's 100% intentional of Anthropic to use "vulnerability" to describe something that ranges from "serious attack vector" to "you forgot to add this variable to the useEffect dependency array".
• perlgeek 5mo ago
  > Software developers should shorten their patch cycles and make security fixes available as quickly as possible. [...] > Network defenders should shorten their patch testing and deployment timelines. Shortening patch cycles will only help so much. It's funny that whenever an NPM supply chain attack is published, people recommend a cooldown before installing new versions, and then when a vulnerability is discovered, everybody jumps to patch. Clearly these two strategies collide at some point. > The critical controls laid out by organizations like the National Institute of Standards and Technology and the UK’s National Cyber Security Centre are now all the more important, since they improve security without depending on any single patch landing in time. These include steps like hardening networks’ default configurations, enforcing multi-factor authentication, and keeping comprehensive logs for detection and response. Most of these proposed controls are not new at all, but they are often costly to implemented and harm velocity in other ways, which is why they aren't widely in place. For example, a super effective control is filtering outgoing network traffic. Many exploits rely on loading second and maybe third stages from the Internet, and if you block outgoing requests by default, it won't work. But, blocking outgoing requests by default is super hard, and you risk blocking security updates etc. It can kinda work for a deployed application, but for an employee workstation? Basically impossible. I wonder if we're approaching an era where we have to go back to saying "you cannot do this, because security" much more often than we'd like.
  • theptip 5mo ago
    > Shortening patch cycles will only help so much. It's funny that whenever an NPM supply chain attack is published, people recommend a cooldown before installing new versions, and then when a vulnerability is discovered, everybody jumps to patch. Clearly these two strategies collide at some point It’s a good point. As things speed up it will be harder to tell which patches are actually urgent and need to skip the cool-off period. I think the more robust way of doing this is to have code audits on each published release. Agents can do some of this (eg Github could offer this scanning service, and let external parties fund the scanning on trusted compute). I think of this more as a “proof of work” problem than provable security; if I see that Mythos has run for N hours on the patch release I am considering upgrading to, then this might suffice. The key thing here is you need a way to crowdsource the funding of scans, and make them shareable so that the cost can be shared across the community. The package owner obviously can’t control the prompt. And can Mythos-class models be hardened enough to scan hostile code? To your point on blocking requests, there are programming models that make this easier, like capability-based programming, where code that doesn’t need internet cannot get it; this doesn’t solve things fully, but my general prediction is that adding new architectural patterns is now a lot cheaper and easier to reliably apply across a codebase, so we may see more of this too.
• PeterStuer 5mo ago
  The 'ethical' AI company creating a 2 tier access world. Who decides who is allowed to check their own codebase for vulnerabilities and who isn't?
• dbacar 5mo ago
  So they gain access to these companies' proprietry software, right?
• bhupendraTale05 5mo ago
  [flagged]
• mcmatterson 4mo ago
  The thing that really gets me as a small-time OSS maintainer is that none of us asked for this. The social and technical millieu where most of us started our projects is not the one we find ourselves in today, and the forces behind this are wildly asymmetric. Security findings are one place where we as maintainers simply do not have the choice to not play ball, whether we like it or not. It seems likely that the only way that we meet the moment is to adopt these tools ourselves -- once again -- whether we like it or not. Reconciling this with the ground truth that 'OSS doesn't owe anyone a goddamn thing' is proving to be really hard for me.
  • deleted 4mo ago
    [deleted]
  • redeye100 4mo ago
    It’s like a modern gun (or nuclear bomb). They’re really only necessary because other people also have guns. We could have all the same effects with swords and bows and arrows. This just 10x’s the effect of deciding to use the thing. So now we need a 10x defense against people deciding to use the thing. Invented a problem and now are selling a solution (but wait not yet… they have to build some more mystery and hype around it)
• harrisaydin77 4mo ago
  [flagged]
• tomascantor 4mo ago
  [flagged]