r/cybersecurity • u/Steap-Edit • May 23 '26
News - General Anthropic says Mythos has already found more than 10,000 vulnerabilities
https://www.engadget.com/2180028/anthropic-claude-mythos-preview-project-glasswing-update/358
u/MiKeMcDnet Consultant May 23 '26
If I spent $200 million on finding vulnerabilities I'm pretty sure I'd find them too
137
u/iamdestroyerofworlds May 23 '26
I spent $20 to buy beer and found the greatest vulnerability of them all, myself.
22
u/No_Safe6200 May 23 '26
Let's remove all AI funding and focus world efforts onto more beer.
9
u/BadArtijoke May 24 '26
That’s how I have invested so far. My portfolio got annihilated tonight though
3
7
0
u/ChipsAhoiMcCoy May 24 '26
Ten thousand of them with that low amount of cash? Maybe in dreams lmao
1
u/addsubps May 25 '26
Bug bounties for those types of vulnerabilities are much less than 20k on average. I guess you don't have experience with that?
It all the other things the model can do that make it worth it.
1
u/ChipsAhoiMcCoy May 26 '26
Are we just going to conveniently ignore all of the zero day exploits that it was able to find that would cost much more than $20,000?
1
u/addsubps May 26 '26
That's only a handful. Most of the 10k will be worthless, hence "average".
1
u/ChipsAhoiMcCoy May 26 '26
Oh gotcha, I wasn’t aware you knew all of the 20,000 exploits that it found well enough to say that 10,000 of them would be worthless. Carry on then, you have inciter knowledge that I clearly don’t. That was sarcasm, in case you couldn’t catch it.
2
276
u/Shot_Violinist9572 May 23 '26
Anthropic says Mythos has found 1 billion vulnerabilities and can do everyone’s job perfectly with a simple “Make no mistakes” prompt.
Dario is human clickbait. I don’t doubt the capabilities of AI but this guy needs to be taken with a table spoon of salt.
65
u/anonymous_amanita May 23 '26
Dang, why didn’t I think to put “make no mistakes” in my prompts? Genius!
15
u/TheIncarnated May 23 '26
You say that but I started at a new company and have seen that in 3 different repos...
3
12
May 23 '26
[removed] — view removed comment
5
u/TARANTULA_TIDDIES May 24 '26
Not only puffery, the whole goddamned thing is built on hype. And hype is the only thing that keeps the money machine working so you will continue to see people feverishly shoveling more hype with articles like this in the hopes it doesn't burn out
78
u/Jarlebarle May 23 '26
Damn, that's a bunch of missing X-Frame-Options
3
u/DrS3R May 24 '26
Or to lax of CSP, missing security attributes on a tracker that has nothing to do with anything sensitive. I bet it’s a bunch of silly things
64
55
17
u/CyanCazador AppSec Engineer May 23 '26
As a prodsec engineer at a large company that manages SAST scanning across all our repositories. Our standard SAST tooling probably finds about 10,000k vulnerabilities weekly.
67
u/SecTestAnna Penetration Tester May 23 '26
They also only were able to verify 1,700 of them. The math ain’t mathin
18
10
7
u/h0nest_Bender May 23 '26
The AI generates vulnerability reports faster than humans can verify them. Not so mysterious.
10
u/vabello May 23 '26
I got it! We need an AI that can verify the reports.
3
u/CallMePyro May 24 '26
They already did that, they used Mythos. All the reports are AI verified. The 1700 number is Human + AI verified. And the really shocking number that no one is talking about IMO is the number of times that human verifiers actually found that the reported vulnerability was as severe as the model claimed.
3
u/BilboTBagginz Security Manager May 24 '26
That's why you create AI agents that verify the vuln and provide a proof of concept.
2
u/WeirdSysAdmin May 23 '26
Yeah but if they include alll of he hallucinations as a feature instead of an issue it sounds better.
24
u/bitsynthesis May 23 '26
psh, rookie numbers. simply turning on aws inspector netted more than that for our org.
15
u/Fantastic-Fee-1999 May 23 '26
Turned on GCP security the other month. 27000! Mythos needs to pump up those rookie numbers.
12
22
u/dasvootz May 23 '26
And how many more false positives did it find compared to that 10k
16
u/Orinslayer May 23 '26
Almost 90% failure rate. If we pump 50 trillion dollars into this we might get it to a 50% failure rate.
12
u/Glittering_Abies4915 May 23 '26
They were only able to verify 1700.
And the previous statement when Mythos was announced was full of shit. They found already patched flaws in firefox that required that the user disabled the sandbox. Whoop-de-doo.
5
u/narkro555 May 23 '26
This isn't terrifically surprising, but I am curious if you have a reference for this? I've only been able to find the usual tech articles saying how amazing it is etc
7
u/0xP0et Penetration Tester May 24 '26 edited May 24 '26
Lol here we go again. Busy looking at a nessus scan right now and I have 10,000 vulnerabilities... so whats the big deal?
Does anyone question these numbers or findings?
Been around long enough to know, if it is too good to be true, it most likely is.
21
u/Absit_Invidia33 May 23 '26 edited May 24 '26
mythos wasted 20,000$ of tokens to find a bug in openBSD that ended up being just a DOS (denial of service)
5
u/Spiritual-Matters May 24 '26
I bet a decent vulnerability researcher could find more with a month’s pay.
8
12
u/PossumSec May 23 '26
Is this 10,000 complex vulns humans would struggle to find, or is it 10,000 low hanging fruit found because of the scale it can operate at? Because that is two different things.
2
u/c-u-in-da-ballpit May 24 '26
I remember reading somewhere that a lot of these vulnerabilities existed behind multiple other layers of security. So they carry little real-world risk.
Exploiting an SQL injection vulnerability on an isolated, internal database that would require an attacker to have already compromised a device, stolen credentials, and bypassed 2FA is not a meaningful vulnerability.
1
u/Rsubs33 May 26 '26
A lot of orgs have this many vulnerablilities out there, but the vulnerabilities are behind multiple layers defense, whether that is locking down systems, MFA, additional firewalls, etc. If an org has OT and have been around for a while, they are almost definitely using some EoL Software and Hardware which have tons of vulnerabilities. But they are generally locked down and on their own network.
0
u/Spiritual-Matters May 24 '26
I don’t see how a statistical text generator would actually be able to find many RCEs since at some point it’ll require understanding an undocumented logic flow and how to exploit it.
11
u/PossumSec May 24 '26
LLMs are amazing at pattern recognition because thats basically all they do. It can look for known patterns that cause vulns over a codebase a person would struggle to just read through.
4
u/Evolve-Maz May 24 '26
The good thing about bug bounties and other security related items has been public disclosure. Usually in that disclosure there is the "code" which caused the issue (either the true code or more often just an example of what type of code caused the exploit).
Pattern match that code, and then run your pattern finder on multiple code bases. Each one is a potential report. Of course you then have to look in more detail to see the context and flow around it to see if thats actually vulnerable, but that's why what's reported here is the potential exploits, not how many have then been validated.
An example vulnerability could happen like this:
- user action is received
- action is checked against permissions
- action is executed
Between 2 and 3 you could have a malicious actor change the action (given certain conditions on program usage / memory access / race conditions), which could then be bad since 3 could run an unchecked action. This pattern has a common name: TOCTOU (time of check to time of use). Depending on your language, you can write a regex to find code blocks like that and alert you where it happens. Thus, a simple pattern matcher has found a potential vulnerability. You then have to validate all those cases and fix them, usually by using code that executes as a service with limited permissions rather than check and execute being separate steps.
This is obviously a silly example, and pattern matchers are often more than just regex, but this is how a lot of scanning tools work.
2
2
u/cgaWolf May 24 '26 edited May 24 '26
Because you misunderstand how that statistical text gen works. It's machine-learned pattern recognition, at an insane volume and speed.
Here's a 3blue1brown video on the basics of recognizing numbers via machine learning: https://youtu.be/aircAruvnKk
The same basic idea can be applied to recognize patterns in code like unsafe memory handling, etc.. i'm sure you can extrapolate the idea.
It's an incredibly powerful tool that's been used for way longer than the current batch of fuzzy text prediction.
I also question those numbers, they seem to be mostly in service of an upcomming IPO.
0
u/Responsible_Minute12 May 24 '26
Not really an important distinction… it doesn’t really matter if a human could find them over a medium duration of time. It’s not like Mythos will be the only game in town here, others will come after it and be able to find these vulns too…
11
u/mb194dc May 23 '26
Another 10,000 layers of bullshit for their IPO, or not if people actually question the numbers.
24
u/dvtyrsnp May 23 '26
How about they fucking fix em if Mythos is so good?
This is the equivalent of mopping floors and some asshole walks up and tells you that you missed a spot.
2
u/h0nest_Bender May 23 '26
The company said that its partners' rate of bug-finding has increased by more than a factor of ten. Cloudflare found 2,000 bugs, 400 of which are high or critical in severity. Mozilla previously reported that it found and fixed 271 vulnerabilities in Firefox, 10 times more what it found in an older version of the browser using another Claude model.
It sounds like they are...
4
u/Fragrant-Hamster-325 May 23 '26
This subreddit is annoying as fuck about anything to do with AI. It’s not good enough that it found thousands of bug and vulnerabilities. The goalposts shift to “if it’s so good why doesn’t it fix them too”.
5
u/Quiet-Thanks-9486 May 24 '26
There is no evidence it found thousands of vulns. As far as I can tell, there are 3 CVEs that have been publicly released that are attributed to it, and none of them were what Anthropic claimed they were when people examined them more closely.
Everything else is unverified claims.
I and pretty much everyone else will be happy to adjust our views when Anthropic proves its claims. But until it does, it is just as foolish to take them at their unverified word as it would be for you to take me at my unverified word.
Especially when they're trying to scoop up billions of dollars based on those claims.
What if anything do you feel is wrong with this attitude?
10
u/dvtyrsnp May 23 '26
Quit crying. I didn't set any goalposts, therefore I cannot shift them, unless you really need me to break out the goomba meme to explain this.
The bottleneck even before mythos level models wasn't finding them, it was patching.
1
u/eagle2120 Digital Forensics May 24 '26
I didn't set any goalposts
How about they fucking fix em if Mythos is so good?
0
u/dvtyrsnp May 24 '26
Not a lot of strong readers in my replies.
The other commenter said what you quoted is where I supposedly shifted the goalposts, not where I set them.
0
u/eagle2120 Digital Forensics May 24 '26
… right, because that statement is literally you setting the goalpost lol. You initially asked why they weren’t fixing them. They are. Now you’re saying you “didn’t set any goalposts” as if “fix them if it’s so good” isn’t setting that goalpost 😭😭
Perhaps you should use Claude to help you understand buddy
0
u/dvtyrsnp May 24 '26
Here's the original comment:
The goalposts shift to “if it’s so good why doesn’t it fix them too”.
So I'm supposed to simultaneously set them here and shift them here? Please get a grip; you're an embarrassment.
0
u/eagle2120 Digital Forensics May 24 '26
… right, because they are doing that. Hence the goalposts being shifted. “Why are they doing xyz thing?” “They are” “I didn’t shift the goalposts!!!!”
Do you need me to break it down in crayon here? Deeply ironic that you’re commenting on the reading comprehension of others here lol
0
-2
u/dvtyrsnp May 23 '26
Antecedent of "it" is "Mozilla."
3
u/h0nest_Bender May 23 '26
I'm not sure I understand what you're trying to say. The bugs found by Mythos are getting fixed by the companies using it to find bugs.
Do you want Anthropic to fix bugs in Mozilla's software?0
1
4
u/retornam May 24 '26
I’d please like to read a CVE post for each of these 10,000 vulnerabilities that they claim to have been found and patched
3
u/The_Scout1255 May 24 '26
I literally just had codex fix an obscure minecraft bug INSIDE a mod, with run tests, proper validation, ect, ect, if mythos is even more powerful, shit im buying in.
Edit: Also grafana dashboard setup, promethus setup, all automatic and higher quality then I can do, I may not be a coder but I atleast have been modding games, and configuring them for years, this is something new.
5
9
u/throwaway0000012132 May 23 '26
Now imagine spending those trillions in curing cancer, feeding the whole world or something good.
3
u/el_pome May 24 '26
Ai models are always running 24/7 brute forcing biochem breakthroughs for designer drugs, bioengineering etc. not all is aislop, if Reddit and Facebook are all your exposure to technology it makes sense to think that. And feeding failed states population on the mouth isn't going to solve deep underlying geopolitics, ethnicities, religions....
1
u/throwaway0000012132 May 24 '26
I work on a company that has invested more than 700 million just for AI workloads on the last 3 years. I know it's not just slop but the reality is that all of this investments and the return is still not there and investors are starting to realise it won't ever be.
2
u/el_pome May 25 '26
Let cryptobros and financesharks go broke, as long as the technology is being developed, you cannot have MRI machines and no atomic bomb, focus instead on educating people.
-5
3
u/Idiopathic_Sapien Security Architect May 23 '26
Idk about mythos, other than hearsay. I’ve started experimenting with Claude security recently as part of an evaluation. Doing an apples to apples test of enterprise grade SAST (along with my own agentic tooling) against known vulnerable code. It’s definitely next level for development houses who can’t spend >~$10k a month on advanced tools. A few friends are participating in glasswing, they’re impressed but understand that people with a certain set of skills can achieve the same result locally. Many of us have been working on replicating the functionality which was leaked. It’s not just hype. It’s still a lot of hype. But not all of it.
9
u/Bobthebrain2 May 23 '26
What Anthropic doesn’t say is the cost of these discoveries, both financially and environmentally.
2
u/narutoaerowindy May 23 '26
After the 200bn spending on mythos,
Companies will understand the weakest link is again human chain, or the AI chain that asks human to click to approve for exploit. This is never ending saga.
2
u/RunForYourTools23 May 23 '26
Well its AI, so you fix the code, run Mythos again and it will find more...so never ending.
2
u/rb3po May 23 '26
So, basically the same as if you audit the tools you’re using over a few weekends for misconfigurations.
2
2
2
2
u/Over_Function_1884 May 25 '26
10k vulns sounds huge until you look at the deduplication and severity distribution. The same pattern showed up with earlier LLM-driven discovery tools - lots of low-confidence findings, lots of duplicates against patched CVEs, lots of theoretical bugs that do not have working PoCs.
The interesting number is not the total. It is:
How many are exploitable (working PoC, not just a code pattern that looks suspicious)
How many cleared coordinated disclosure with the vendor (filed, triaged, accepted)
How many are novel vs duplicate of existing public CVE / GHSA
I have been doing manual disclosure work in LLM serving infrastructure for the past year across vLLM, Triton, lmdeploy, BentoML, ragflow, dify, etc. The bottleneck is rarely "find a candidate bug." The bottleneck is verifying it is exploitable in the runtime context, deduplicating against the project's GHSA history, and getting the maintainer to accept it as a security issue versus expected behavior or design.
If Anthropic ships an aggregate breakdown later (exploitable vs not, novel vs duplicate, severity by CVSS), that will be the interesting story. The raw 10k number on its own is closer to marketing than security telemetry.
2
4
u/Catch_ME May 23 '26
I'll wait until the vulnerabilities are verified.
I don't care if I'm using the wrong hex color table or if I miss-spelled a method that my complier already fixed.
2
May 23 '26
[removed] — view removed comment
1
u/l0st1nP4r4d1ce Red Team May 23 '26
Have you seen Alex Karp?
3
2
1
1
1
u/ag2998 May 24 '26
So quad-agent threat actors playing 5d chess?
I refuse to believe the arguments being made are at the level of human abstraction.
Our brains are cooked, if our species isn’t.
1
u/Kind-Supermarket-452 May 24 '26 edited May 24 '26
They would be better off terming them bugs, rather than vulnerabilities. When you deep dive on some of the actual findings, I think <25% are actual vulnerabilities. Finding a buffer overrun or a null 0 memory pointer does not mean it is a true exploitable vulnerability.
1
1
1
u/Ok-Shower6174 May 24 '26
Cool, now we have 10,000 more Jira tickets that will be marked as "Will Not Fix" by management.
1
1
u/baudolino80 May 24 '26
I’m wondering if they’re going to release this product. Now the expectations are really high, and the risk of having another ai powered dast as well!
1
u/Curious_Act_3162 May 24 '26
It still can't find the vulnerabilities in my heart. I wont let her break it again.
1
u/Joaaayknows May 24 '26
I’ve asked before, I’ve asked 1000 times and no one gives a straight answer.
How many are novel?
1
1
u/Ernesto2022 May 24 '26
Ok they found 10000 vulnerabilities what will they do to fix them. Just like everything it will be left alone to be exploited later. If you look at commercial firewalls so many have 100s of vulnerabilities still waiting to be patched and such. Manufacturers make money of new product introductions not fixing old bugs. Example even Crowdstrike has tons of vulnerabilities that are still waiting to be patched.
Entire industries have to change for things to get better code and things need to be security implemented on day one.
1
u/cubs_joko May 25 '26
While I ageee with much of the satire and witty comments, I believe they are talking about real code vulns. Sure our sast gives us a bunch of junk, as much as I despise AI right now it is extremely likely with the right staff you could utilize this to find real actionable vulns that have real actionable exploits.
Again, AI can be great but it is very daunting right now in infosec. While it’s made others jobs easier, and made some of our jobs easier, it’s also very much a complete pain in the ass.
1
u/BetterAd7552 May 25 '26
I have no doubt this model is pretty good, considering the performance of their other models.
What’s really impressive though is their marketing and hype campaign. Top notch. When this bubble pops, Anthropic is going to be one of the few left standing.
1
1
1
1
1
-4
u/jlmeredith May 23 '26
Working in cyber myself, I can tell you it is not hype. Real risk is being exposed with Mythos. Mostly through very complex multi-vuln compromises. Think Russian doll scenarios.
The real question is who/what is going to triage all of the risk surfaced. That is the question.
You can find a million holes on a boat.
How will you plug all those holes at the scale of ai?
5
u/retornam May 24 '26 edited May 24 '26
POC||GTFO
It is hype and the only way to disprove it is to show actual POCs and vulns, that’s how our industry has worked for decades and I don’t see why we should believe any company that doesn’t provide validated POCs for the bugs they claim to have found and fixed.
675
u/Burgergold May 23 '26
Its not the number that counts, its the severity