NCCapital

Anthropic’s restricted Claude Mythos model was supposed to represent a new frontier in AI-assisted vulnerability discovery. Then it was tested against curl, one of the most important and heavily used open-source tools on the internet.

The result was awkward, but also more interesting than the easy headline.

According to curl lead developer Daniel Stenberg, Mythos found five supposed security issues in curl’s roughly 178,000 lines of code. After review, only one was accepted by the curl team as a real vulnerability, and it was rated low severity. Three were already known and documented behaviors, and one was considered a normal bug rather than a security flaw.

That outcome has created a split reaction. One side sees it as proof that the hype around Mythos is mostly marketing. The other side sees it as proof that curl is simply very mature, heavily audited, and unusually hard to break.

The truth is probably between those two positions.

The Mythos Test Was Not a Failure, But It Was a Reality Check

Finding one real vulnerability in curl is not nothing.

Curl is everywhere. It is used across servers, developer tools, phones, cars, embedded systems, cloud environments, and countless software pipelines. A real curl vulnerability, even a low-severity one, matters because of the tool’s reach.

But Mythos was not being judged like an ordinary static analysis tool. Anthropic had positioned the model as unusually powerful, restricted to a small number of major organizations because of misuse concerns. If the public expectation is that a frontier AI system can rapidly uncover large numbers of serious zero-days, then finding one low-severity issue in curl is a much more modest result.

That is why the curl test matters. It forces the security industry to separate two claims:

• AI tools are getting better at finding vulnerabilities. That appears true.
• AI tools are suddenly superhuman zero-day engines across mature codebases. That remains unproven.

Why Curl Is a Hard Target

Curl is not some neglected library sitting untouched in a forgotten repository. It is one of the most visible and battle-tested open-source projects in the world.

It has a long security history, a dedicated maintainer community, broad usage, and years of attention from researchers. Stenberg has said curl has already been analyzed by tools such as Zeropath, AISLE, and OpenAI’s Codex, which helped uncover hundreds of issues and a dozen or more confirmed vulnerabilities.

That context matters. If several AI-assisted tools have already gone through the codebase, there may be fewer obvious issues left for Mythos to find.

So the result could mean Mythos is overhyped. It could also mean curl is a bad benchmark for dramatic claims because the easy and medium-difficulty bugs have already been picked over.

Key idea: The real test of AI bug hunting is not whether it can find vulnerabilities. It is whether it can find important vulnerabilities that elite humans and earlier tools missed.

AI Vulnerability Research Has a Signal Problem

The Mythos curl result highlights one of the biggest problems with AI security research: signal quality.

A model can generate a long list of possible issues, but human experts still have to validate them. Some findings may be real. Some may be duplicates. Some may be documented behavior. Some may be ordinary bugs. Some may be technically interesting but not exploitable.

That validation burden matters. If an AI system produces too many low-quality findings, it does not save researchers time. It creates triage work.

The best AI security tools will not be the ones that produce the longest reports. They will be the ones that produce the highest-value findings with the least wasted review time.

Mozilla’s Results Tell a Different Story

The curl result is not the whole Mythos story.

Mozilla reportedly had a much stronger experience with Mythos, finding more than 270 Firefox vulnerabilities. That sounds far more impressive. But even there, the interpretation is not simple.

Mozilla noted that the vulnerabilities could also have been found by elite human researchers. The advantage was speed. Mythos compressed discovery time, reducing the gap between when an attacker might find a bug and when the vendor can patch it.

That may be the most realistic near-term value of AI vulnerability research.

AI may not instantly replace top-tier human researchers. But it can help vendors audit more code, generate more hypotheses, test more paths, and close more issues faster than human teams could alone.

The “Dangerous Model” Narrative Needs Evidence

Anthropic’s restricted access model implies that Mythos could be dangerous if misused. That may be true. A model that accelerates vulnerability discovery could help defenders, but it could also help attackers.

Still, the industry should be careful with claims that sound dramatic but are not backed by public evidence.

If a model is described as capable of finding thousands of zero-days, security teams will naturally ask: What kind of zero-days? In what codebases? How severe? How many were exploitable? How many were duplicates or low-impact issues? How many were independently confirmed?

Without those details, the claim becomes hard to evaluate.

The curl case is useful because it is concrete. A real maintainer reviewed actual findings against a real codebase. That kind of validation is more valuable than broad marketing language.

What This Means for Open Source

AI-assisted auditing could become a major benefit for open-source security, but only if it is handled responsibly.

Popular open-source projects are often maintained by small teams, sometimes by one or two overworked people. Flooding them with AI-generated vulnerability reports could become a burden if the reports are weak.

Maintainers do not need more noise. They need concise, reproducible, well-explained findings with clear security impact.

The future may require a new etiquette for AI-generated security reports:

• Do not submit unverified model output as a vulnerability.
• Include a minimal proof of impact, not just a suspicious code path.
• Clearly label AI-assisted findings.
• Respect maintainer triage capacity.
• Prioritize quality over volume.

If AI vulnerability research becomes a spam cannon, maintainers will ignore it. If it becomes a disciplined assistant to real researchers, it could materially improve software security.

Why This Matters for Enterprises

Enterprises should pay attention because AI-assisted vulnerability discovery is moving from research novelty to operational reality.

Security teams already struggle with code volume. Modern organizations maintain internal applications, cloud infrastructure, APIs, dependencies, containers, CI/CD pipelines, and third-party integrations. Human review cannot scale across all of it.

AI tools can help find bugs faster, but enterprises should not treat them as autonomous security authorities. They still need human review, exploitability assessment, secure development practices, patch prioritization, and regression testing.

The right use of AI is not “let the model decide what is vulnerable.” The right use is “let the model expand what human security teams can inspect.”

The Bigger Lesson

The Mythos debate shows how immature the AI security conversation still is.

People want a clean answer: either AI is overhyped, or AI is about to dominate vulnerability research. The actual answer is more complicated.

AI tools are clearly improving. They can find real vulnerabilities. They can accelerate research. They can help defenders move faster. They may also lower the barrier for attackers.

But mature, heavily audited codebases are still hard targets. Human validation still matters. Severity still matters. Exploitability still matters. And marketing claims still need proof.

The Bottom Line

Claude Mythos finding only one real low-severity vulnerability in curl does not mean AI bug hunting is useless.

It means AI bug hunting needs better benchmarks, better public evidence, and less vague hype.

The most important question is not whether AI can find bugs. It can. The question is whether AI can consistently find meaningful, exploitable, previously missed vulnerabilities without burying maintainers in false positives.

For now, Mythos looks less like a magic zero-day machine and more like a powerful but still limited research accelerator.

That may sound less dramatic, but it is probably closer to the truth.

Sources

• SecurityWeek: Claude Mythos Finds Only One Curl Vulnerability