Hacker News: goobreee

New comment by goobreee in "Six curl CVEs after OpenAI and Anthropic came back with zero"

goobreee — Wed, 02 Sep 2026 18:37:38 +0000

i think a key missing part is that an LLM on its own can't find vulnerabilities, so it's always an AI + harness. even mythos, when used for finding zero-days, is using an actually surprisingly heavy handed and expensive scaffold. they literally make it run in parallel on ±all files and ask "what's wrong with this?". here from the mythos technical blog post [1]:

> To increase efficiency, instead of processing literally every file for each software project that we evaluate, we first ask Claude to rank how likely each file in the project is to have interesting bugs on a scale of 1 to 5. A file ranked “1” has nothing at all that could contain a vulnerability (for instance, it might just define some constants). Conversely, a file ranked “5” might take raw data from the Internet and parse it, or it might handle user authentication. We start Claude on the files most likely to have bugs and go down the list in order of priority.

So they process it in parallel, but AI-rank them based on vuln-likelihood first = exhaustive search with a heuristic filtering first

[1] https://www.anthropic.com/research/mythos-preview

New comment by goobreee in "Six curl CVEs after OpenAI and Anthropic came back with zero"

goobreee — Wed, 02 Sep 2026 15:09:41 +0000

i don't think this is correct. if you look at this article by the curl founder daniel stenberg (https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-v...), he talks about how he previously ran Mythos on curl and that it found 5 issues: 1 turned out to be a low severity CVE, 3 were false positives, and 1 just a bug. So a) Mythos detects low severity CVEs too, and b) it is fairly noisy

New comment by goobreee in "Six curl CVEs after OpenAI and Anthropic came back with zero"

goobreee — Wed, 02 Sep 2026 15:07:44 +0000

i don't think this is doable fairly. as they say in the blog post, the only fair way to is to look for new, previously undiscovered zero-days, otherwise you always risk the model has in some way been trained on the vulnerabilities. looking for legit new stuff is the only way to prevent leakage (even accidental one)

New comment by goobreee in "Six curl CVEs after OpenAI and Anthropic came back with zero"

goobreee — Wed, 02 Sep 2026 15:06:26 +0000

I think you might be misunderstanding this? This is, from my understanding, what went down:

1. curl was scanned by many different things, including AISLE, and many bugs were fixed <- all this was in the past 2. curl a week ago was scanned again my Mythos and Codex Security, and both of them said: 0 issues found 3. the same curl was scanned by AISLE a day later, resulting in ~29 reports (based on the blog post and mastodon posts from Daniel Stenberg) 4. of these 29, 6 cleared the bar and got CVEs in curl 5. these 6 CVEs were just announced as fixed in curl 8.22.0 today, together with 4 more CVEs that were detected by other people prior to point 2. of this list

so imho it was head-to-head, the very same codebase => it's a legit comparison

Six curl CVEs after OpenAI and Anthropic came back with zero

goobreee — Wed, 02 Sep 2026 13:43:14 +0000

Article URL: https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero

Comments URL: https://news.ycombinator.com/item?id=49536114

Points: 182

# Comments: 66

"Mythos" at Home, and It's Called Aisle

goobreee — Wed, 17 Jun 2026 15:31:00 +0000

Article URL: https://stanislavfort.substack.com/p/mythos-at-home-and-its-called-aisle

Comments URL: https://news.ycombinator.com/item?id=48571884

Points: 7

# Comments: 0