Seven Months After The Boy That Cried Mythos

It’s been over six months since I wrote “The Boy That Cried Mythos“, and Anthropic’s vulnerability dashboard has been growing.

Let’s take a look at the 8,527 findings added in its latest month. During this same month, human reviewers checked 253 findings and maintainers pushed 113 patches. These three numbers come from Anthropic’s own counts. I got them by comparing the 2 November snapshot of its disclosure dashboard with the 2 October snapshot.

In April, in my section 8 of “The Boy That Cried Mythos”, I presented eleven things that a security capability claim should carry (things the Mythos system card lacked). Seven months later Anthropic’s own dashboard and Patrick Garrity’s November audit at VulnCheck reveal where we are now.

Then in May I laid out the funnel behind the headline: 23,019 findings, about 8% of them checked by a human, and a true positive rate that described only the checked ones. The funnel continues to have a similar look in November. It has 37,966 findings and 17% are checked, where the dashboard’s patched count has gone from 97 in May to 629. That’s not nothing, but it’s still hardly something to get excited about. I feel like I’m reading about a security team doing security work, which usually has to pay to get a press release.

The true positive rate is the number Anthropic naturally leads their overheated marketing with, and it rose from 92.7% to 94.2% in a month. That’s a 1.5. Over that month the reviewed count rose by 253, from 6,123 to 6,376. The confirmed count rose by 335, from 5,674 to 6,009. That seems to show the confirmations were higher than reviews by 82. The dashboard shows a single snapshot instead of explaining the trend line. It does state that a duplicate counts as valid finding, and on that note the same update marked 1,654 entries as duplicates.

I’m not sure why duplicates are valid except as an attention inflationary tactic. Accountants know better, and so does every bug bounty program that credits the first report and cancels every single duplicate as nothing to see.

The dashboard’s count of findings reported to maintainers fell in the same month from 6,157 to 5,087, and Garrity’s own count reaches even lower to 4,866. The count that maintainers replied to fell from 5,103 to 3,635. The 94.2% covers only findings that went through triage. Of the 5,087 the dashboard counts as reported, 3,225 went out untriaged and carry this rather inconvenient label:

May contain false positives.

Yeah. Probably should say will contain false positives.

Anthropic’s two versions actually disagree on fixes. Garrity counts 217 marked fixed in Anthropic’s ledger while Anthropic’s dashboard says 629 patched. In September the same pair read 202 and 421. This interesting integrity gap has nearly doubled. I use the larger number in the table because it is the most generous reading available, and it still comes to only 1.7%.

I think it makes sense to check curl, because it has been so well documented.

First, in May a Mythos report claimed five confirmed vulnerabilities in curl and one survived as a low.

Second, in October the scanner found a real one. Daniel Stenberg called CVE-2026-92392, a high-severity use-after-free in HTTP/2 uploads, “one of the worst vulnerabilities in curl in a long time” and credited it to Luna Tong at Anthropic using OSS Scanner. curl fixed it in 8.23.0 on 14 October. That is a scanner working as a patch accelerator, which is exactly what section 10 of the April post predicted.

Third, this month Stenberg received 45 more reports from the scanner, each filed as a vulnerability, with one rated medium and 44 rated low. He estimated four hours of triage per report, so about four weeks of full-time work, and published all 45 as GitHub issues. His tally on 10 November accounts for all 45: seven confirmed at low severity, 37 “just a bug” and one completely false. Seven of 45 is 16%. Anthropic told maintainers at launch to expect a true positive rate above 90%.

The scanner can claim 44 real defects out of 45 as a headline driving announcement, while curl can count seven vulnerabilities, all low. The difference between them is the marketing, because Anthropic filed all 45 as vulnerabilities. It’s like when Ed Bernays ran propaganda to get people to eat more fatty, unhealthy bacon. He had a doctor ask 5,000 physicians whether a hearty breakfast beats a light one, about 4,500 agreed, and the newspapers ran it as 4,500 physicians urging hearty breakfasts, with bacon and eggs served up as the example. Nine out of ten doctors recommend. Recommend what? Look away, don’t check the details. That’s how disinformation tactics in America made bacon so popular, manipulating a report that never said eat bacon.

One report claimed request smuggling. Hah, gotta love that phrase. Stenberg’s verdict:

Sounds like a bug, not a vulnerability.

Classic. Every security professional hates to hear that. It’s like nails on a chalkboard. Each report now arrives with a reproducer and candidate patches, which answers some of what I was talking about last May. It still drops a bill of four hours on a maintainer. The same morning Stenberg counted 218 bugfixes merged from 49 authors in the 27 days since the last curl release, with 19 CVEs queued for the next one. Anthropic accounts for at most seven out of those 19.

We focus on curl when it is among the most fuzzed and audited C codebases known. The May report and this month’s batch produced eight lows between them, and October produced the one high. Results on other targets are notably different. Grav, a PHP content management system, turned 99 scanner findings into 22 advisories, and wolfSSL’s founder told Anthropic that 72 of 74 reports were valid. Stenberg wrote in May that any project new to this generation of tools will find a large pile of bugs, because that’s how technology works. New tools, new batches of bugs. It’s the obvious progression. A new analyzer behaves newly on code it has yet to see. By August Stenberg posted that Mythos was delivering nothing more in curl, and AISLE says its own tool still produced 29 reports and six CVEs. AISLE is the firm in April that reproduced the Anthropic launch showcase bugs on small open models, throwing a wet blanket on the whole announcement. Each tool, each pivot, will deliver bugs that others missed. In other words, finding bugs continues to be a commodity market.

Attackers are also ignoring the marketing, making use of bugs found by other means. Jeremiah Grossman’s Vulnpocalypse Report for Root Evidence went looking for an AI surge in exploitation across 253,912 CVEs published since 2018, of which 3,769 were exploited. The exploited share held flat to falling and the median time from patch to exploitation widened. Its conclusion:

AI has changed one group so far, and we can name it: researchers.

That’s basically what this blog has argued since April. The proof is in. A follow-up Root Evidence chart of this year’s CVEs entering VulnCheck’s exploited list shows weekly additions rising from six in the first quarter to 16 in the third, with WordPress plugins left out. The bars sum to roughly 500 exploited CVEs through 8 November. Root Evidence notes that later weeks draw on a larger pool of CVEs, so part of the climb is just dumb math. VulnCheck’s list holds two CVEs credited to Anthropic. Glasswing launched on a claim of thousands of high-severity vulnerabilities in every major operating system and browser. Shocking if true! But then all but two of the bugs that attackers used this year came from NOT the cartel of Anthropic. When Mythos 5 came out in June, the successor to the preview that had been billed as too dangerous to release, Anthropic put the same underlying model on general sale as Fable 5 behind a filter.

Also in June I set a test for the 90-day report Anthropic promised at launch. A verified CVE list with reproduction steps would substantiate the claims they had made. Headline figures restated without independent verification would confirm the pattern. The deadline passed by July 6th and the May update remained our only report to chew on. What exists for us since is just the dashboard and an October announcement. The open source side of the program met part of it with 230 CVE records on the dashboard and scanner reports that ship with a reproducer. However, the partner side is what the consortium launch was supposedly all about, and it closed with… a survey. Glasswing ended as a named program on October 6th (what is it about the 6th?), when Anthropic merged it into its Cyber Verification Program. The closing number was 129,000 verified vulnerabilities found by partners, based only on a survey from some of those partners. It all seems shady, because the two partner counts I checked earlier both shrank against the published advisories. Mozilla’s 271 reconciled to three Anthropic-credited CVEs, and Palo Alto’s 26 falls to 20 once its own exclusion is applied.

Section 9 of my Cried Mythos post said this about speed:

A tool that accelerates discovery without accelerating remediation grows the backlog; it does not shift the threat model.

In May I called the result a firehose in a blizzard. Section 10 of my Cried Mythos post said a defensive tool calls for a CVE velocity report in place of a fire alarm. The dashboard is that report, and it reads 113 patches against 8,527 new findings.

On 8 October Anthropic wrote that verifying, disclosing and fixing vulnerabilities “is slow and still depends on people”.

The billions and billions of dollars spent on Anthropic now pumps out raw sewage reports unreviewed to the projects that opt in, while the humans cleaning up the spill are volunteers known as maintainers.