Hacker News Reader

Comment by bpodgursky | Hacker News Reader

Sorry but if you stepped back for a moment you'd realize this is all contrived nonsense to let to have your cake and eat it too.

No, Anthropic did not mind-game the US government into being worried about cybersecurity. The NSA has been paranoid about cyber controls for longer than you've been alive. If Anthropic had come out of the gate saying "no don't worry man, our model is TOTALLY COOL", while simultaneously attacking HAWK and finding core Linux vulnerabilities, I assure you the US government would have caught up about ten minutes later and we'd be in exactly the same spot minus your ability to tell Anthropic they were wearing the wrong dress and asking for it.

View on HN

Mythos isn't some scary dangerous model that can find high severity bugs seamlessly, that's just Anthropic marketing. Most of the vulnerabilities they found were low severity hyped up to make their model look good, with (I think, maybe?) the exception of a few.

Now that Chinese open weight models have similar capabilities, and their guardrails can also just be removed, it doesn't look like anyone has "hacked" into everything because of the scary dangerous models like Anthropic were making it out to be.

In principle I agree but in practice I don’t.

The majority of high severity vulnerabilities are not the kind of thing you need a PhD in Comp Sci to comprehend, they are mostly about finding a way to get a system to end up in a state different than was anticipated when entering a particular code path.

Exhaustively looking at code and identifying ways to do this is something LLMs are quite good at. They don’t get tired, and you can run them non-stop.

They're also (generally) quite good at reading the literal meaning of the code, whereas humans often see the intended meaning first, and can be biased.

If you had a tireless junior engineer who was given the job of “make this application get into a state it’s not supposed to be in”, you’d probably get similar results.

What Mythos is quite good at is both the first bit and coming up with ways it could chain that together with other bits of unexpected state to create something that forms a meaningful vulnerability rather than a dead end.

It's also quite hard to separate Mythos the model from Mythos the campaign (aka Glasswing).

They put an enormous amount of compute into bug hunting, and they found some bugs. Fair enough. For me that begs the question: what if they had spent the same compute on generating more tokens with a less-capable model? What if they had spent it on traditional fuzzing?

All models find vulnerabilities. What is special about this generation of SOTA models, including Mythos/Fable (the same model), GPT-5.6, Kimi-K3, and now GLM-5.3 — they can chain vulnerabilities and produce working exploits.

Look at the recent HuggingFace hack. One vulnerability was template injection, another — remote code execution. Combine them and you pwned the remote server.

People working under Project Glasswing reported that Mythos at one point chained 20 vulnerabilities to produce working exploit. Humans don’t usually do that.

If you think all of these models aren’t finding important bugs everywhere I think your not being honest with yourself.

In fact I think the opposite is true. The Zcash bug was found with opus 4.6 or something like that. Many worse models currently in the wild might be very capable but not yet industrialized for bug finding.

Another example from today. Cryptography system that’s been around for decades: https://eprint.iacr.org/2026/1630

It’s going to be a bumpy few months

Reply on news.ycombinator.com