curl's Daniel Stenberg Says Anthropic's Mythos Found One Low-Severity Bug in 178,000 Lines, Calls the Hype 'Primarily Marketing'

Overview

Daniel Stenberg, the longtime lead maintainer of curl, used a May 11 blog post to publish the first independent results of running Anthropic’s Claude Mythos against curl, the C library and command-line tool embedded in more than twenty billion devices. The model produced a single confirmed low-severity vulnerability, scheduled to land with curl 8.21.0 in late June — a result Stenberg framed as evidence that the wider Mythos rollout has been driven more by marketing than by a step change in code analysis.

The post lands a month after Mozilla credited Mythos with the 271 vulnerabilities patched in Firefox 150 as previously reported, the result that put Anthropic’s Project Glasswing initiative on defenders’ maps in the first place.

What the Scan Found

Access to Mythos came through the Linux Foundation’s Alpha Omega program rather than from Anthropic directly. As Stenberg recounts on his blog, he did not run the model himself; another party performed the analysis and shared the resulting report with the curl security team.

The scan covered 178,000 lines of code across curl’s src/ and lib/ subdirectories. The Mythos report came back with five items it labelled “confirmed security vulnerabilities.” After the curl security team worked through the list, the count collapsed: one real low-severity flaw, three false positives that traced back to documented API behaviour, and one ordinary non-security bug.

Stenberg described the initial reaction in his post: “Five issues felt like nothing as we had expected an extensive list. Once my curl security team fellows and I had poked on this short list for a number of hours and dug into the details, we had trimmed the list down and were left with one confirmed vulnerability,” he wrote on daniel.haxx.se.

The remaining real bug will ship as a low-severity CVE alongside the next curl release. “The single confirmed vulnerability is going to end up a severity low CVE planned to get published in sync with our pending next curl release 8.21.0 in late June,” Stenberg wrote, adding that “the flaw is not going to make anyone grasp for breath,” per his blog.

SecurityWeek put the curl result in context against the project’s longer security history: curl has had 188 CVEs assigned over its lifetime, the outlet reported, citing Stenberg’s post.

Stenberg’s Read on the Hype

The blog post is also one of the most pointed public assessments of Mythos from a working maintainer rather than from a customer or competitor. Reflecting on the model’s initial launch, Stenberg wrote that “the whole world seemed to lose its marbles. Is this the end of the world as we know it? An amazingly successful marketing stunt for sure,” on his blog.

His bottom-line judgement was framed in similar terms. “My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing,” Stenberg wrote, on daniel.haxx.se. “I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.”

SecurityWeek carried the same conclusion, and Stenberg’s own post offered a vivid sizing of the codebase Mythos had searched: “curl is currently 176,000 lines of C code when we exclude blank lines. The source code consists of 660,000 words, which is 12% more words than the entire English edition of the novel War and Peace,” he wrote on daniel.haxx.se.

What He Isn’t Claiming

Stenberg’s broader stance on AI-assisted code analysis is more nuanced than the headline framing suggests. In the same post he wrote that “AI powered code analyzers are significantly better at finding security flaws and mistakes in source code than any traditional code analyzers did in the past,” on his blog, and that “any project that has not scanned their source code with AI powered tooling will likely find huge number of flaws, bugs and possible vulnerabilities with this new generation of tools.”

The specific objection is about Mythos’s place in that landscape, not about AI scanning as a category. Stenberg’s argument is that on a heavily fuzzed and audited codebase, the model’s hit rate looks broadly similar to what existing tooling can already deliver, not that AI-driven analysis is useless.

Industry Reaction

SecurityWeek reported that experts are divided on what the curl result implies. Some argue that curl is one of the most-audited C codebases in existence — Stenberg himself uses that framing in his post — and that finding only one new bug is a sign of curl’s maturity rather than a verdict on Mythos. Others, SecurityWeek noted, are sceptical that Mythos genuinely surfaced “the only remaining” curl vulnerability and view that outcome as improbable.

The Mythos vs. Firefox figures, which set the original expectation level, came from a very different starting point. Mozilla’s Mythos run produced 271 patched vulnerabilities across the Firefox codebase, SecurityWeek reported, and Mozilla itself characterised the work as a defender-side breakthrough at the time.

The contrast between Mozilla’s Firefox numbers and Stenberg’s curl numbers is now the central question for Project Glasswing customers: is Mythos’s value concentrated in large, less-audited codebases where conventional tools have not exhaustively run, or does it generalise to mature C projects? Stenberg’s data point pulls toward the former. The same vendor competition that has produced OpenAI’s GPT-5.5-Cyber rollout and Microsoft’s MDASH disclosures will play out against a more cautious benchmark as a result.

What We Don’t Know

Stenberg has not published the specific CVE identifier or the technical detail of the confirmed vulnerability, both of which are slated for the curl 8.21.0 advisory in late June, per his blog. The Mythos report’s full list of five candidate findings has not been published either; only the curl team’s triage outcome is public.

Anthropic has not responded publicly to Stenberg’s post in the SecurityWeek write-up, which did not quote the company. The Alpha Omega program’s process for selecting which open-source projects receive Mythos access, and the contractual terms attached to that access, were not disclosed in the cited coverage.