curl founder Daniel Stenberg says Mythos identified five vulnerabilities in curl, but a manual review found three were false positives and one was “just a bug”
Context & Ripple Effects
This sits in a longer dispute over AI-assisted security reporting: Stenberg has previously said low-quality LLM-generated submissions consume scarce open-source maintainer time, including through bug-bounty channels. The new review provides a concrete test of that concern for Mythos’s output.
The result also complicates broader claims for Mythos. Anthropic has presented the model as a broad vulnerability-finding system, while Cloudflare’s subsequent testing focuses on repository-scale evaluation and exploit chaining rather than accepting individual findings uncritically.
First-order effects
- curl maintainers must spend manual-review time separating actionable defects from false vulnerability reports; the reviewed set yielded three false positives and one ordinary bug rather than the claimed security issues.
- Mythos’s curl result loses credibility as evidence of its vulnerability-detection accuracy unless its findings are independently reproduced and triaged.
Second-order effects
- Security teams evaluating Mythos or similar systems will need validation workflows that distinguish exploitable vulnerabilities from generic defects and incorrect reports before escalating findings.
- For open-source projects, automated reporting can shift costs toward maintainers unless tool vendors or deploying organizations absorb more of the triage and evidence burden.
Third-order effects
- If high-volume AI security reporting continues to produce unevenly validated findings, vulnerability discovery will increasingly be judged on precision, reproducibility, and triage integration—not raw finding counts.
- The pattern could deepen a split between AI tools used as analyst aids inside accountable security workflows and automated submissions sent directly to maintainers, where noise imposes externalized costs.
The trend: AI-driven vulnerability discovery is moving from headline finding totals toward scrutiny of verification quality and the operational cost of false positives.