Provenance Record

News-category (~1,031 words). Overview / What the Scan Found / Stenberg's Read on the Hype / What He Isn't Claiming / Industry Reaction / What We Don't Know structure. Crucially includes the 'What He Isn't Claiming' section that surfaces Stenberg's broader-positive view of AI scanning — preserves nuance that the headline framing alone would have lost. Neutral tone. Internal links to two prior Machine Herald articles (Firefox 150 / 271 vulnerabilities, OpenAI GPT-5.5-Cyber) both exist in the content collection — verified.

{"source-0":{"url":"https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/","snapshot":"source-0.html.gz","status":"Primary publication (Rule 9): Stenberg's own blog post. Every direct quote verified verbatim. 178K analyzed LOC + 176K total LOC distinction confirmed. 188 lifetime CVEs verified. 'War and Peace' / 660,000 words sizing verified."},"source-1":{"url":"https://www.securityweek.com/claude-mythos-finds-only-one-curl-vulnerability-experts-divided-on-what-it-really-means/","snapshot":"source-1.html.gz","status":"SecurityWeek. Verifies 188 CVE lifetime figure, 'experts divided', 'the only remaining' skeptic framing. NOTE: SW actually says 'more than 270 Firefox vulnerabilities' — the article attributes the precise 271 number to SW but the precise figure traces to the prior Machine Herald Firefox 150 article. Filed correction."},"source-2":{"url":"https://it.slashdot.org/story/26/05/11/199232/anthropics-bug-hunting-mythos-was-greatest-marketing-stunt-ever-says-curl-creator","snapshot":"source-2.html.gz","status":"Slashdot summary. Verifies 'greatest marketing stunt' framing and Stenberg attribution."},"source-3":{"url":"https://www.heise.de/en/news/Mythos-finds-a-security-vulnerability-in-curl-11291980.html","snapshot":"source-3.html.gz","status":"Heise. Corroborates Mythos / curl vulnerability finding."}}

Substantively strong commentary piece. All Stenberg quotes verified verbatim against the daniel.haxx.se primary post: 'Five issues felt like nothing as we had expected an extensive list...trimmed the list down and were left with one confirmed vulnerability'; 'severity low CVE planned to get published in sync with our pending next curl release 8.21.0 in late June'; 'the flaw is not going to make anyone grasp for breath'; 'the whole world seemed to lose its marbles. Is this the end of the world as we know it? An amazingly successful marketing stunt for sure'; 'My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing'; 'I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos'; 'curl is currently 176,000 lines of C code when we exclude blank lines'; 'AI powered code analyzers are significantly better at finding security flaws and mistakes in source code'; 'any project that has not scanned their source code with AI powered tooling will likely find huge number of flaws'. The 178K-line headline figure also verified: Stenberg's blog explicitly says 'It counted 178K lines of code analyzed in the src/ and lib/ subdirectories' — so the headline correctly uses the analyzed-LOC figure (178K) and the body separately quotes the total-LOC figure (176K) for sizing the codebase. 188 lifetime CVEs verified in Stenberg's post and corroborated by SecurityWeek. Slashdot snapshot confirms 'greatest marketing stunt' framing. Heise corroborates curl vulnerability finding. One minor cite scope issue: article says SecurityWeek reported '271 patched vulnerabilities across the Firefox codebase' but SecurityWeek's snapshot actually says 'more than 270 Firefox vulnerabilities'. The precise 271 figure traces to the Machine Herald's own April 22 Firefox 150 article (internal link present). Compatible numbers but the cite should have pointed to the prior Machine Herald article or to Mozilla directly.