Mythos finds a curl vulnerability

[CiotBSD]

Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead trickle it out to a selected few companies for a while to allow a few good ones(?) to get a head start and fix the most pressing problems first, before the general populace would get their hands on it…

• https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

---

ping: https://framapiaf.org/@bagder@mastodon.social/116554421974341351

[naltun]

I love bhyve but OpenBSD's security defaults (as well as its cohesiveness) are what pulled me to hosting on OpenBSD. vmm(4) is not a bad hypervisor, hopefully more work goes into it.

[CiotBSD]

What is the relationship between vmm and curl?

[grahamperrin]

Thanks! Also:

• Mythos finds a curl vulnerability | Lobsters
• Mythos Finds a Curl Vulnerability | Hacker News
• Mythos finds a vulnerability in curl, a single low severity one, and curl's creator is not impressed, calls it "a succesful marketing stunt". : r/BetterOffline and (old Reddit) nine other discussions …

[grahamperrin]

Linked from the commentary, the gov.uk domain:

• Our evaluation of OpenAI's GPT-5.5 cyber capabilities | AISI Work