Mythos found a curl vulnerability

Anthropic's Mythos scanned the curl source code and reported 5 confirmed vulnerabilities, but after review by the curl security team, only 1 remained a real vulnerability.

• 3 of the rest were false positives, mistakenly flagged as vulnerabilities when they were actually limitations already documented in the API docs.
• 1 of the rest was reclassified as a regular bug, not a vulnerability.
• The remaining 1 case will be treated as a low severity CVE and disclosed at the end of June together with curl 8.21.0.
• Beyond the vulnerabilities, the Mythos report also listed about 20 bugs, and the curl team is fixing the ones they agreed with, one by one.

The analysis covered about 178,000 lines of code in src/ and lib/, targeting a recent master commit. However, since curl is a codebase that has already been heavily vetted with tools like OSS-Fuzz, Coverity, and CodeQL, almost no major new issues turned up in core paths such as HTTP/TLS/URL parsing.

The piece also notes that curl has already been using AI tools such as AISLE, Zeropath, and OpenAI Codex Security, and that over the past 8 to 10 months, AI-based analysis has led to 200-300 bug fixes and 12 or more CVEs. Even so, looking at this result alone, the evaluation is that there is weak evidence that Mythos is clearly superior to previous tools at code analysis.