Anthropic's magic code-sniffer: More Swiss cheese than cheddar, for now
Anthropic's AI code analysis tool, Mythos, shows promise in automating the detection of known software vulnerabilities but currently struggles to identify flaws beyond those already recognized by human experts. While it can scale the efficiency of skilled developers, it does not yet discover novel vulnerabilities or revolutionize security on its own. The article suggests a cautious, phased rollout like Project Glasswing is prudent, given the fragility of existing codebases. The long-term vision is a future where AI and human expertise combine to make software security more systematic and proactive.
- ▪Mythos excels at finding known classes of vulnerabilities but does not detect previously unknown or novel flaws.
- ▪The tool was used to identify 271 Firefox vulnerabilities, all of which could have been found by human experts.
- ▪Project Glasswing limits early access to trusted partners as a responsible deployment strategy.
- ▪The author compares future software security to aviation safety, suggesting that rigorous tools and practices can drastically reduce failures over time.
- ▪AI vulnerability detection tools are expected to become widely available, inevitably improving code quality but also requiring careful transition management.
Full article excerpt tap to expand
Security 9 Anthropic's magic code-sniffer: More Swiss cheese than cheddar, for now 9 AI vuln-hunter finds what humans taught it to find. Funny that Rupert Goodwins Mon 27 Apr 2026 // 08:30 UTC Opinion In retrospect, calling it Mythos made it a hostage to fortune. Anthropic may have hoped that the name implied its AI code security model had mythical god-like powers, but there's an alternate reading. Another definition for Mythos is a set of beliefs of obscure origin which are incompatible with reality. That reality is trickling in, and it’s looking less mythical, more typical. Mythos is a great tool that can automate a lot of the things expert humans do, and it’s the expert humans who get the most from it. It is very good at finding classes of vulnerability that humans know about, while not finding ones that they don’t. Training, amirite? Project Glasswing, limiting early use to trusted partners with a real need, is probably a responsible approach to using its powers for good, but other unrestricted models are quite good at this too. Some hype, some truth, LLMs gonna LLM. Mythos found 271 Firefox flaws – but none a human couldn't spot READ MORE It is cynical to say the only real innovation is an AI company operating ethically. Equally cynical is seeing the closed roll-out and the attendant publicity as merely an exercise in hype. It is more constructive, arguably more accurate, and certainly more exciting, to take all this as an early glimpse of a better future. One where the threat landscape stops being a function of geological and climactic forces we can’t control, turning instead into one cultivated, controlled and gratifyingly anti-climactic. Two propositions point the way. One is that the effectiveness of tools like Mythos will continue to evolve, exposing more and more structural and individual code flaws. The other, that these tools will inevitably become generally available. How quickly and cheaply may be controllable, but the outcome is inevitable. There are no long-term secrets in IT. Right now, and for some time to come, most running code has been written in the pre-industrial age of vulnerability detection. Eyeballs, not AI balls, did the work. This is a bad public environment to dump roaming packs of implacable vuln-hunting robots. If they come too soon, it’ll be messy. And they are coming. <a href="https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ae9mf4yW2Jxtp0t7utwTmgAAAgA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0" target="_blank"> <img src="https://pubads.g.doubleclick.net/gampad/ad?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ae9mf4yW2Jxtp0t7utwTmgAAAgA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0" alt=""> </a> But if we survive that transition intact, then let the robots roam at will. There is one class of code that is guaranteed to present no security risks whatsoever, and that’s undeployed code. New code has a lot of problems, some caught before deployment and some that aren’t, but never an infinite number. Where truly excellent tools exist, code can be made truly excellent before release. It doesn’t matter if the same tools are available to the bad guys thereafter. AI quota inflation is no token effort. It's baked in Apple's chips are the core of a new…
This excerpt is published under fair use for community discussion. Read the full article at The Register.
Discussion
0 commentsMore from The Register
