CIRCLE WITH A DOT

Mythos and its impact on securityI’m sure by now you’ve all read the news about Anthropic’s new “Mythos” model and its apparently “dangerous” capabilities in finding security vulnerabilities. I’m sure everyone reading this also has opinions about that. Well, here are a few of mine.http://neilmadden.blog/2026/04/14/mythos-and-its-impact-on-security/

I’m all for the idea that putting open source software out there shouldn’t land you with endless responsibility for free support. On the other hand, publishing releases to PyPI/Maven Central/wherever does IMO send a signal that you think something is fit for purpose, and then you should own that.

There is a possible world in which LLMs are good for security: where people vibe-code the 5% of a bloated product/library they actually need and avoid a lot of CVEs in the other 95%. Obviously, that won’t happen. (My guess is that products will bloat even more to tip the buy/build scales back to buy).

@neilmadden I hear what you‘re saying. Just one more thing I think the reason why they call it „dangerous“ is that is has gotten much better at developing working exploits than previous models.Sorry same source https://red.anthropic.com/2026/mythos-preview/

@hacksilon I’m also super interested in how well it generalises to non-memory-safety vulns. How load-bearing is ASan as a quality gate here, and what other classes of vulns have similar oracles?

Mistook the full stop for a comma in this caption: thought this guy looked pretty relaxed given the massive role he just had in international diplomacy!

@fanf do you think fixing that is more of a challenge than HS2?

Someone should really start an Organic Software movement - made by humans, for humans.

Petition to add "agreeing what constitutes a breaking change" to the Hard Problems of Computer Science.