Anthropic’s Mythos AI, touted as a revolutionary security scanner, identified only one low-severity vulnerability in cURL, a widely used open source project that has long undergone extensive security testing. cURL’s developer, Daniel Stenberg, says the results fall short of the marketing buzz surrounding the model.
- Mythos flagged only one low-severity vulnerability in cURL.
- Four other reported 'issues' were either false positives or non-security bugs.
- cURL has seen hundreds of bug fixes from earlier AI and static analysis tools.
What happened
Anthropic’s AI model Mythos scanned the source code of cURL, an established open source project known for its extensive security scrutiny. Rather than receiving direct access to Mythos, cURL’s lead developer Daniel Stenberg was provided a report from the scan by someone with access through Anthropic’s Project Glasswing program. This report listed five alleged security vulnerabilities.
Upon review, Stenberg and his security team found only one confirmed vulnerability deemed low severity, with the remaining four issues being false positives or minor bugs that did not significantly affect security. The confirmed bug is scheduled to be patched in the upcoming cURL 8.21.0 release planned for late June.
Why it matters
Mythos has been marketed by Anthropic as a groundbreaking AI for security flaw detection, but the limited findings in cURL’s heavily examined codebase suggest the model does not currently surpass existing tools by a meaningful margin. This challenges expectations about AI’s immediate impact on software vulnerability detection.
cURL’s development team has previously used multiple AI tools, including OpenAI Codex Security and Zeropath, which helped uncover numerous vulnerabilities over the past year. Mythos's modest contribution so far underscores that even advanced AI models may not necessarily revolutionize code analysis when applied to mature, rigorously tested projects.
What to watch next
The response to Mythos’s performance will likely shape how AI vulnerability scanners are perceived in the near term, especially from vendors positioning their products as transformative for security testing. More real-world assessments on diverse and less scrutinized codebases will be needed to clarify Mythos’s practical value.
Meanwhile, the cURL security team continues to integrate bug fixes from a variety of AI and traditional tools, potentially benefiting from Mythos’s ability to identify non-security bugs. Observers will watch if Anthropic releases expanded access to Mythos and whether future iterations can deliver more compelling security insights.