Mythos finds curl vulnerability after Anthropic’s AI model completed a comprehensive security analysis of the widely-used curl library in May 2026. The scan examined 178,000 lines of C code across curl’s src and lib subdirectories, identifying five potential security issues that were later narrowed down through manual review by curl’s security team.

The curl security team investigated each of the five findings reported by Mythos over several hours. Their manual verification process revealed that four of the five issues were not confirmed vulnerabilities. Three were false positives highlighting documented API limitations, while one was classified as a general bug rather than a security flaw. Only one issue qualified as a confirmed vulnerability, rated as severity low and scheduled for publication with curl’s upcoming 8.21.0 release in late June 2026.

curl’s Security Track Record and Scale

curl operates at massive scale across modern infrastructure. The project serves over twenty billion installed instances running on more than 110 operating systems and 28 CPU architectures. It executes on every smartphone, tablet, car, television, game console, and server globally. The codebase contains 176,000 lines of C code (excluding blank lines) equivalent in volume to 12 percent more words than the entire English edition of War and Peace.

The curl project has published 188 CVEs to date. Development has involved 1,465 individuals who contributed code merged into the repository over time, with 573 individuals currently credited for existing production code in git master. Each production source code line has been written and rewritten an average of 4.14 times, reflecting substantial refinement. Mythos finds curl vulnerability within this heavily audited codebase already subject to OSS-Fuzz, Coverity, CodeQL, and multiple paid cybersecurity audits.

Previous AI Code Analysis Tools and Their Impact

Before the Mythos analysis, curl had undergone scanning with multiple artificial intelligence-powered code analysis tools. AISLE, Zeropath, and OpenAI’s Codex Security were used to examine the codebase over an 8-10 month period. These earlier tools collectively triggered between 200 and 300 bug fixes merged into curl. Many findings were confirmed vulnerabilities published as CVEs, numbering approximately a dozen or more.

The curl project currently uses GitHub’s Copilot and Augment code to review pull requests, with their automated findings helping developers avoid merging new bugs. AI reviews supplement rather than replace human code review. Security researchers increasingly use AI to identify vulnerabilities, generating a high volume of quality security reports for the curl project.

Mythos Report Findings and Bug Classification

The Mythos analysis report contained additional bugs beyond the five flagged as potential vulnerabilities. The report identified approximately twenty bugs total, with most receiving detailed explanations and high certainty assessments. curl’s team is investigating each bug, fixing those deemed valid. The volume of issues discovered by Mythos was smaller than outputs from earlier AI tools used on curl, which is expected as simpler bugs have already been addressed through prior scans.

The report noted zero memory-safety vulnerabilities found during the analysis. Methodology documentation indicated hand-driven analysis using language model subagents for parallel file reads, with every candidate finding re-verified through direct source inspection before recording. No automated SAST tooling was used. The outcome aligns with curl’s status as one of the most heavily fuzzed and audited C codebases in open source.

How Modern AI Code Analyzers Differ from Traditional Tools

Modern AI code analyzers detect mismatches between code comments and actual implementation. They can analyze code for platforms and configurations that traditional analyzers cannot directly run against. AI models maintain knowledge about third-party libraries and their APIs, enabling detection of abuse or incorrect assumptions in API usage.

AI analyzers understand protocol specifications that curl implements, allowing them to identify code details that may violate or contradict protocol requirements. These tools excel at summarizing and explaining discovered flaws in ways that traditional static analysis tools struggle to match. Many AI analyzers can generate patch suggestions for identified issues, though the patches frequently require refinement before deployment.

All modern security analysis models now perform effectively at finding flaws. Any project not using AI-powered code analysis tools risks leaving vulnerabilities undetected for adversaries and attackers to discover and exploit. The curl project benefits from continuous improvement through both AI and human-driven security practices combined.

Expectations Versus Reality

Mythos received extensive media attention in April 2026 when Anthropic described the model as exceptionally effective at discovering security flaws in source code. The company restricted initial access to select organizations through Project Glasswing, creating significant public discussion about the implications for software security. The curl project anticipated extensive findings when offered access to the model.

The actual results suggest the considerable hype surrounding Mythos was primarily driven by marketing messaging. The findings do not demonstrate a significantly higher detection rate or fundamentally different approach compared to earlier AI code analysis tools. While Mythos may offer modest improvements, the degree of advancement does not appear substantial enough to produce a major shift in code security analysis practices. This assessment is based on curl’s specific experience and may not reflect Mythos performance across other codebases or different analysis targets.

AI-powered code analyzers remain substantially better at identifying security flaws than traditional code analyzers developed in prior decades. Projects that have not yet applied AI-based code analysis tools will likely discover significant numbers of bugs and potential vulnerabilities. The continued evolution of AI models and new prompting techniques will likely uncover additional issues in curl and other projects over time.

Source: daniel.haxx.se