Post #1293181
2026-04-17 22:56 UTC
The security blog I linked the other day has more criticisms of Anthropics mythos cybersecurity claims:
-Apparently Opus 4.6 may have found the FreeBSD Anthropic has made a huge deal about Mythos finding? And Anthropic didn’t clarify that there older model had found the bug as well: flyingpenguin.com/freebsd-cve-2026-4747-log-sugge…
-More explanation about why Anthropic’s entire approach with Mythos and cybersecurity is more oriented around marketing than good (or any) cybersecurity practices. Also, the author makes the point that if you did have a tool that could rapidly refactor code into other languages, the solution to the vast majority of bugs and vulnerabilities Mythos found isn’t bug hunting one by one with Anthropic’s (much more expensive) LLM, it is to refactor code into a memory safe language. (I think the author is too credulous of LLM coding agents code quality here, but given those assumptions I think there point is correct.) flyingpenguin.com/how-sans-mythos-marketing-disap…
-Bonus, MCP (model context protocol, a standard for tools for LLM agents Anthropic has developed and tried to push) is insecure by default and Anthropic has refused to fix it! flyingpenguin.com/ox-security-report-anthropic-mc…
Replies (2)
-
@Architeuthis@awful.systems 2026-04-18 06:45
The MCP thing feels like an I like to leave my keys as a huge bulge under the welcome mat type vulnerability. It seems really easy to not do that and also something that is kind of out of scope for both lock makers and mat salesmen to address directly. Maybe the MCP ecosystem is such that it’s hard to both avoid this and keep the impression that you’re doing magic and not just implementing a heavily annotated API, ideally secured and with specific and well-defined functionality, and also they are all hacks.
-
@lurker@awful.systems 2026-04-19 05:59
refreshing to see people tale actual deep dives and explain in detail why Mythos is nonsense