Mythos hot take

Ever since Anthropic did their whole Mythos / Project Glasswing media circus thing, the world seems to be divided between panic and boredom. I have to admit I've been more on the side of the skeptics.

One article really stuck with me though: Daniel Stenberg, the founder of cURL and libcurl, had the codebase of cURL audited with Mythos and wrote about the results. It's well worth a read, but the TL;DR is that Mythos claimed five "confirmed" security vulnerabilities. These were triaged down to three false positives, one bug, and one low severity vulnerability. Doesn't seem like a big deal, right?

However, there is some really important context: cURL is probably one of the most heavily audited and reviewed codebases in existence. The project team are well aware of how widely deployed cURL is (it's probably running on dozens of devices in your house and you have no idea). They take security very seriously. Again, read the article for the details.

The point being that cURL is the exception. Not just in the open-source world (although, sure, there's a bunch of crappy open-source code out there), but I'm talking enterprise applications. You know, the things that run business of all sizes. The things that are pushed to market as soon as possible to maximise the revenue.

Is AI-powered discovery going to be weaponised to find and exploit previously unknown vulnerabilities? Probably. But the threat here isn't some new-fangled thing from Anthropic. Just as it's always been, the problem is shitty code written by shitty developers working for shitty companies that don't care about the impact of their MVP crapplications.