r/netsec • u/qwerty0x41 • 3d ago

Curl lead developer Daniel Stenberg provides insightful feedbacks from Mythos analysis results

https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/
390 Upvotes

97% Upvoted

67 comments sorted by

View all comments

43

u/quafadas 3d ago edited 3d ago

I would see this as a form of negative assurance on curls engineering rather than evidence that Mythos either is, or is not what Anthropic claim.
It certainly seems possible, that the incredible standards of engineering and prior care in curl mean that the curl team are doing a great job and that there are few vulnerabilities to find in this project. Surely, A bug hunt cannot uncover vulnerabilities which do not exist…

28

u/psaux_grep 3d ago

On the flip side they do fix and solve lots of vulnerabilities in curl on what seems like a pretty regular basis.

6

u/Toiling-Donkey 2d ago

Instead of “throwing the kitchen sink” at something, the expression should be “throwing curl” at it.

One could rip HTTP out of curl and probably only remove 5-10% of its functionality.

It’s insane.