5 ms·

When Fable was yanked, it was said to be (in part) due to the "jailbreak" of instructing Fable to "fix this code" — https://news.ycombinator.com/item?id=4855268

When Fable was yanked, it was said to be (in part) due to the "jailbreak" of instructing Fable to "fix this code" — https://news.ycombinator.com/item?id=48552687 https://news.ycombinator.com/item?id=48552687 Dumb question. If "Mythos-class" models are such a problem, then... why not just let it fix everyone's code? There can't be more than a few million to tens of millions software businesses / services / regularly used F/OSS projects on Earth. Why not just give everyone a $100 Fable / Mythos credit to "fix [their] code?" It would arguably benefit Anthropic. For $100M to $1B, Anthropic could execute the greatest ad campaign in human history. And they'd make the entire world more secure. Most people aren't malicious. If you, as an engineer, consultant, founder, business owner, or maintainer, were given access to Mythos' capabilities wouldn't you ask it to fix your code? I might be wrong. But I think that a greater amount of harm will be done in the long-term by trying to lack these capabilities and systems away behind permission gates and sealed doors. It creates an asymmetric world with haves and have nots. And in that world who gets to have access now decides who gets to be secure. If everyone has mythos, no one has "Mythos." Just let people fix their code.

Gigachad 3mo ago
I think there is some logic in delaying the rollout, giving it to the heads of the largest software products first to fix their code before dumping it on the general public. But yes eventually everyone will have this tech and it won't matter because the low hanging fruit will have all been picked clean.
ashu1461 3mo ago
I think eventually there will be Mythos grade AI which will be released which can solve a lot of bugs, even right now opus/fable can fix more things which companies can even keep track of. The problem is how to make sure such AI is released safely. The same AI that can solve bugs can also find bugs in authentication or loopholes in critical systems.
bluGill 3mo ago
I doubt most bosses will give engineers the time. They care about security only to the extent that they have already been harmed by a lack of it. I would like to play with mythos, but on my own time my kids have plenty of activities to fill my time. My personal backlog of projects is only getting longer and none of it is something mythos could help. If I had more time is have restored my old truck instead of making payments on something new (in turn limiting what else I can afford to buy)
andy99 3mo ago
> If "Mythos-class" models are such a problem, then... why not just let it fix everyone's code? Because it doesn’t really confer the advantage they claim, especially compared to e.g. paying an equivalent amount of money to do traditional security scanning. It’s much better to play of FOMO and hype than to let everyone use it and be underwhelmed.
- usef- 3mo ago
  Are you claiming that LLMs aren't finding new issues compared to previous methods? There's a huge number of security issues coming out in recent months, especially via Anthropic (glasswing etc). We don't have to take their word for it: look at the code. Some open source maintainers are talking about burnout due to spending so much time patching.
  - computably 3mo ago
    Spending their time patching, or reviewing slop "patches"?
    - usef- 3mo ago
      They're not slop, if you're talking about recent ones. You might still be operating on information for a year or two ago. Here's the curl project talking about the strain they're under from real reports (despite being a mature and well-vetted project): > A thirty years old project could make you think you’ve seen most things already, but we have not been in this situation before. > The rate of incoming security reports is 4-5 times higher than it was in 2024 and double the speed of 2025 – meaning that on average we now get more than one report per day. The quality is way higher than ever before. The reports are typically very detailed and long. - https://daniel.haxx.se/blog/2026/05/26/the-pressure/ https://daniel.haxx.se/blog/2026/05/26/the-pressure/ --- Linux kernel maintainer Greg Kroah-Hartman: > "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now." - https://www.theregister.com/software/2026/03/26/linux-kernel-czar-says-ai-bug-reports-arent-slop-anymore/5226256 https://www.theregister.com/software/2026/03/26/linux-kernel... --- And ffmpeg, who previously complained about slop, 2025: https://xcancel.com/FFmpeg/status/1984220199193891166 https://xcancel.com/FFmpeg/status/1984220199193891166 Now say serious issues are being found, 2026: https://xcancel.com/FFmpeg/status/2066169070387413147 https://xcancel.com/FFmpeg/status/2066169070387413147 (I only point out their previous stance to show that they're not coming from pure AI hype.)
StilesCrisis 3mo ago
I don't think a one-time $100 credit is enough. First of all, that isn't very much. But also, the volume of new code is going way up. Unless they keep giving out monthly free credits, it's just a stopgap.
benlivengood 3mo ago
> Dumb question. If "Mythos-class" models are such a problem, then... why not just let it fix everyone's code? That's basically project Glasswing; mixing responsible disclosure with frontier exploit generators.
usef- 3mo ago
They are doing that (see their project glasswing over the past few months), but there's a lot more code in the world than you realise. The problem with rolling it out is that bad and good actors can both use it at the same time, and bad actors will typically move faster than typical day-to-day software projects and patching schedules, so they set up glasswing to give access to the major producers and projects to patch their own software before it becomes available more widely (they've submitted tremendous numbers of security issues to open source projects)
deleted 3mo ago
[deleted]
machinist5 3mo ago
> Most people aren't malicious. If you, as an engineer, consultant, founder, business owner, or maintainer, were given access to Mythos' capabilities wouldn't you ask it to fix your code? 1. Some do not want to use LLMs because of grave ethical concerns. 2. Some do not want to use LLMs because of copyright concerns. Google v Oracle looms large in the background. 3. You presume the outcome of Fable / Mythos is a net positive for a FOSS project. Reviewing a firehose of code written without the context of the values and considerations of a particular project shaped over years or sometimes decades of formal and informal decisions is not necessarily the best use of the maintainers time.
xboxnolifes 3mo ago
For starters, it's probably closer to $10,000 per codebase for Fable/Mythos for a full review. That would be around 5 years of their current spending I think. They really want that level of spend coming into the company, not going out.
slashdave 3mo ago
> why not just let it fix everyone's code? That's the stated idea. Fix code before releasing to the public.
paxys 3mo ago
$100 credit on Fable/Mythos will last a grand total of 10 minutes.
overgard 3mo ago
Because this is all kayfabe. You cannot take a single thing these companies or people say at face value.
Majromax 3mo ago
> Dumb question. If "Mythos-class" models are such a problem, then... why not just let it fix everyone's code? In the specific case of cybersecurity, this is a reasonable medium-term outcome. IMO, the cybersecurity risk is akin to the spread of a disease among an 'immune-naive' group: we can suddenly deploy much stronger attack-finding tools against large, established codebases created with much weaker security designs. The path from here to there will be rough, but it's still fundamentally easier to write secure code than it is to exploit vulnerabilities. (It's just easier yet to write insecure code, giving our status quo problem.) For other 'safety' matters, defense isn't so easy because the attack and target are so different. An AI propaganda bot or catfisher 'attacks' slowly-evolving human culture; one that instructs on explosives or bioterrorism directly interacts with an accomplice and not a victim. If you believe that knowledge on how to build a pipe-bomb must be restricted, then giving everyone access to Fable does not mitigate the risk. The controversial limit of this attitude is recursive self improvement and an AI singularity with potentially destructive results. Proponents of this view think that sufficiently powerful AI is risky in nearly unimaginable ways such that the capability itself is harmful. This is part (but not all) of why Fable (originally?) degraded itself when apparently assisting with AI research.
pejrich 3mo ago
It's not that simple. The odds are always stacked in favor of the hacker. It's like saying, "why not just make a prison that's impossible to escape from". You can make a prison very, very hard to escape from, but you have to shut off every possible way someone could try to escape, whereas someone trying to escape only has to find one vulnerability, once. It's much harder to plug every possible hole in a complex system than it is to find one point of weakness.

Gigachad 3mo ago

I think there is some logic in delaying the rollout, giving it to the heads of the largest software products first to fix their code before dumping it on the general public. But yes eventually everyone will have this tech and it won't matter because the low hanging fruit will have all been picked clean.

ashu1461 3mo ago

I think eventually there will be Mythos grade AI which will be released which can solve a lot of bugs, even right now opus/fable can fix more things which companies can even keep track of. The problem is how to make sure such AI is released safely. The same AI that can solve bugs can also find bugs in authentication or loopholes in critical systems.

bluGill 3mo ago

I doubt most bosses will give engineers the time. They care about security only to the extent that they have already been harmed by a lack of it. I would like to play with mythos, but on my own time my kids have plenty of activities to fill my time. My personal backlog of projects is only getting longer and none of it is something mythos could help. If I had more time is have restored my old truck instead of making payments on something new (in turn limiting what else I can afford to buy)

andy99 3mo ago

> If "Mythos-class" models are such a problem, then... why not just let it fix everyone's code? Because it doesn’t really confer the advantage they claim, especially compared to e.g. paying an equivalent amount of money to do traditional security scanning. It’s much better to play of FOMO and hype than to let everyone use it and be underwhelmed.

usef- 3mo ago
Are you claiming that LLMs aren't finding new issues compared to previous methods? There's a huge number of security issues coming out in recent months, especially via Anthropic (glasswing etc). We don't have to take their word for it: look at the code. Some open source maintainers are talking about burnout due to spending so much time patching.
- computably 3mo ago
  Spending their time patching, or reviewing slop "patches"?
  - usef- 3mo ago
    They're not slop, if you're talking about recent ones. You might still be operating on information for a year or two ago. Here's the curl project talking about the strain they're under from real reports (despite being a mature and well-vetted project): > A thirty years old project could make you think you’ve seen most things already, but we have not been in this situation before. > The rate of incoming security reports is 4-5 times higher than it was in 2024 and double the speed of 2025 – meaning that on average we now get more than one report per day. The quality is way higher than ever before. The reports are typically very detailed and long. - https://daniel.haxx.se/blog/2026/05/26/the-pressure/ https://daniel.haxx.se/blog/2026/05/26/the-pressure/ --- Linux kernel maintainer Greg Kroah-Hartman: > "Something happened a month ago, and the world switched. Now we have real reports." It's not just Linux, he continued. "All open source projects have real reports that are made with AI, but they're good, and they're real." Security teams across major open source projects talk informally and frequently, he noted, and everyone is seeing the same shift. "All open source security teams are hitting this right now." - https://www.theregister.com/software/2026/03/26/linux-kernel-czar-says-ai-bug-reports-arent-slop-anymore/5226256 https://www.theregister.com/software/2026/03/26/linux-kernel... --- And ffmpeg, who previously complained about slop, 2025: https://xcancel.com/FFmpeg/status/1984220199193891166 https://xcancel.com/FFmpeg/status/1984220199193891166 Now say serious issues are being found, 2026: https://xcancel.com/FFmpeg/status/2066169070387413147 https://xcancel.com/FFmpeg/status/2066169070387413147 (I only point out their previous stance to show that they're not coming from pure AI hype.)

StilesCrisis 3mo ago

I don't think a one-time $100 credit is enough. First of all, that isn't very much. But also, the volume of new code is going way up. Unless they keep giving out monthly free credits, it's just a stopgap.

benlivengood 3mo ago

> Dumb question. If "Mythos-class" models are such a problem, then... why not just let it fix everyone's code? That's basically project Glasswing; mixing responsible disclosure with frontier exploit generators.

usef- 3mo ago

They are doing that (see their project glasswing over the past few months), but there's a lot more code in the world than you realise. The problem with rolling it out is that bad and good actors can both use it at the same time, and bad actors will typically move faster than typical day-to-day software projects and patching schedules, so they set up glasswing to give access to the major producers and projects to patch their own software before it becomes available more widely (they've submitted tremendous numbers of security issues to open source projects)

deleted 3mo ago

[deleted]

machinist5 3mo ago

> Most people aren't malicious. If you, as an engineer, consultant, founder, business owner, or maintainer, were given access to Mythos' capabilities wouldn't you ask it to fix your code? 1. Some do not want to use LLMs because of grave ethical concerns. 2. Some do not want to use LLMs because of copyright concerns. Google v Oracle looms large in the background. 3. You presume the outcome of Fable / Mythos is a net positive for a FOSS project. Reviewing a firehose of code written without the context of the values and considerations of a particular project shaped over years or sometimes decades of formal and informal decisions is not necessarily the best use of the maintainers time.

xboxnolifes 3mo ago

For starters, it's probably closer to $10,000 per codebase for Fable/Mythos for a full review. That would be around 5 years of their current spending I think. They really want that level of spend coming into the company, not going out.

slashdave 3mo ago

> why not just let it fix everyone's code? That's the stated idea. Fix code before releasing to the public.

paxys 3mo ago

$100 credit on Fable/Mythos will last a grand total of 10 minutes.

overgard 3mo ago

Because this is all kayfabe. You cannot take a single thing these companies or people say at face value.

Majromax 3mo ago

> Dumb question. If "Mythos-class" models are such a problem, then... why not just let it fix everyone's code? In the specific case of cybersecurity, this is a reasonable medium-term outcome. IMO, the cybersecurity risk is akin to the spread of a disease among an 'immune-naive' group: we can suddenly deploy much stronger attack-finding tools against large, established codebases created with much weaker security designs. The path from here to there will be rough, but it's still fundamentally easier to write secure code than it is to exploit vulnerabilities. (It's just easier yet to write insecure code, giving our status quo problem.) For other 'safety' matters, defense isn't so easy because the attack and target are so different. An AI propaganda bot or catfisher 'attacks' slowly-evolving human culture; one that instructs on explosives or bioterrorism directly interacts with an accomplice and not a victim. If you believe that knowledge on how to build a pipe-bomb must be restricted, then giving everyone access to Fable does not mitigate the risk. The controversial limit of this attitude is recursive self improvement and an AI singularity with potentially destructive results. Proponents of this view think that sufficiently powerful AI is risky in nearly unimaginable ways such that the capability itself is harmful. This is part (but not all) of why Fable (originally?) degraded itself when apparently assisting with AI research.

pejrich 3mo ago

It's not that simple. The odds are always stacked in favor of the hacker. It's like saying, "why not just make a prison that's impossible to escape from". You can make a prison very, very hard to escape from, but you have to shut off every possible way someone could try to escape, whereas someone trying to escape only has to find one vulnerability, once. It's much harder to plug every possible hole in a complex system than it is to find one point of weakness.