curl founder Daniel Stenberg says Mythos identified five vulnerabilities in curl, but a manual review found three were false positives and one was “just a bug”
yes, as in singular one. — Back in April 2026 Anthropic caused a lot of media noise when they concluded …
Context & Ripple Effects
Mythos arrived with Anthropic’s broad claim that the model had found thousands of high-severity vulnerabilities across major software categories. That made individual maintainer validation important evidence about how those aggregate findings translate to real-world security work.
For curl, this also extends Daniel Stenberg’s earlier warning that AI-assisted reports can consume scarce open-source maintainer time when submissions are not sufficiently verified. Cloudflare’s subsequent repository testing shows the tool is also being evaluated through more structured, organization-led workflows.
First-order effects
- curl’s maintainers had to manually investigate five Mythos findings; Stenberg says three were false positives and another was a non-security bug, sharply reducing the actionable security result from the report.
- Anthropic’s Mythos output faces a concrete accuracy challenge in a prominent open-source project, reinforcing that its findings require human triage before being treated as vulnerabilities.
Second-order effects
- Security teams and open-source maintainers evaluating Mythos are likely to weight proof quality, reproducibility, and triage cost alongside raw finding counts.
- Vendor and enterprise evaluations can shift toward controlled repository tests and exploit-validation harnesses, like the approach Cloudflare describes, rather than accepting model-generated reports as stand-alone evidence.
Third-order effects
- If high-volume AI vulnerability discovery repeatedly produces costly false positives, the differentiator will become validation workflows that turn candidate bugs into confirmed, prioritized fixes—not headline-scale discovery totals.
- The pattern could deepen the burden on under-resourced maintainers unless tool providers or adopters absorb more of the verification work; the curl case alone does not establish how representative the error rate is.
The trend: AI security tooling is moving from impressive vulnerability-discovery claims toward scrutiny of precision, exploitability, and the human cost of validating model-generated findings.