{"generated_at":"2026-11-12T18:49:19.508Z","source":{"name":"Hacker News public API","url":"https://github.com/HackerNews/API","attribution":"Stories and comments are public Hacker News submissions by their respective authors. HackerHub is an independent reader, not affiliated with Y Combinator.","content_is_untrusted":true},"story_id":50447074,"hn_url":"https://news.ycombinator.com/item?id=50447074","total_comments":217,"returned":20,"scope":"Up to the requested number of top-level comments in Hacker News ranked order. Deleted comments are omitted. Nested replies are not fetched; this is not the complete thread.","comments":[{"id":50448590,"author":"enthuseyourcurb","created_at":"2026-11-11T01:10:10.000Z","text":"As someone working at a bigtech co that has spent every single working day (and many weekends) since the launch of Mythos patching serious, company-ending type of security issues, these types of posts really irk me.\nPublic datasets of CVEs being underwhelming doesn't mean much if all of the issues are in private company codebases that will never get a CVE number assigned and will never get a fancy blog post. You're never going to hear about them, and the people working on them probably can't tell you about them, but that doesn't mean they don't exist.\nWe're all worried about OSS having security issues because of how widely used things like PHP or curl are... but the same can be said about email providers, document collaboration SaaSes, payment processors, etc that millions of companies depend. Those companies will never be in datasets like this, and they'll never publicly disclose how many issues they found.","parent_id":50447074,"replies_count":13,"hn_url":"https://news.ycombinator.com/item?id=50448590"},{"id":50448745,"author":"pizlonator","created_at":"2026-11-11T01:30:50.000Z","text":"I received 9 reports of Fil-C issues from Anthropic\nAll of them were real bugs. None of them were false positives.\nThe quality of the reports was exceptional. (My baseline is doing security defense on a browser engine, so my baseline has a large sample count and is probably representative of what experts are capable of.)\nThe quality of the proposed fixes was alright. I took some of the fixes verbatim. I used most of the fixes as significant inspiration for doing it my way.\nThe quality of the test cases was exceptional.\nMaybe I’m special somehow! But I just want to call out the enormous chasm between what I saw of anthropic’s capability and what TFA says","parent_id":50447074,"replies_count":11,"hn_url":"https://news.ycombinator.com/item?id=50448745"},{"id":50448290,"author":"snowwrestler","created_at":"2026-11-11T00:30:50.000Z","text":"The PHP2Shell vulnerability ended up being paradoxically comforting for me.\nThey turned frontier models loose on PHP, and the big one they found was based on a previously known logic flaw that was extremely difficult to exploit. Which makes sense: hence the need for frontier models.\nAnd in the wild, while there have been many attempts and a few simple demo successes, the practical impact has seemed to be small, seemingly constrained by the length of the chain and the diversity of PHP configs.\nIn short, it was indeed a major vulnerability, but not magic (in the Arthur C Clarke sense).\nI think ultimately the fear comes down to: do you believe that code can be secured. I recognize that there is probably no objective way to deductively prove it because of the Halting Problem etc. But if one believes code can be constructed to operate to spec, then there must be a limit to the damage an LLM can do, even a very smart one.\nI think we are going through a phase where a lot of known triaged code shortcomings will get exposed and hopefully fixed. Sucks while it is happening. But not actually the first round of this type of evolution. And ultimately I think as before, we will come out the other side with more secure and durable technology.","parent_id":50447074,"replies_count":7,"hn_url":"https://news.ycombinator.com/item?id=50448290"},{"id":50448662,"author":"rurcliped","created_at":"2026-11-11T01:18:48.000Z","text":"The blog is misleading because it tries to characterize Project Glasswing's effectiveness through use of a tangentially related data source. A Project Glasswing vulnerability discovery most often occurs when a Glasswing partner points a Mythos-class model at its own, often proprietary, software. The data source (aka \"ledger\") is only for the Anthropic coordinated vulnerability disclosure program for open source software: in other words, Anthropic itself pointing a Mythos-class model at an OSS package, and then notifying the maintainer afterward that it had done this, and had findings to share. This OSS work is certainly useful, but the number of fixes reflects - in part - limited time availability by volunteer OSS maintainers, and Anthropic sometimes working without knowledge of the OSS project's threat model (the threat model is explicitly requested in the newer oss-scanner effort). Percentage fixed is often much higher for use of Glasswing with proprietary software, e.g., https://blog.cloudflare.com/cyber-frontier-models/ \"Our research with Mythos Preview was conducted in a controlled environment against our own code; every vulnerability surfaced through this work was triaged, validated, and remediated where action was needed under Cloudflare's formal vulnerability management process.\"","parent_id":50447074,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50448662"},{"id":50447443,"author":"dfee","created_at":"2026-11-10T22:53:43.000Z","text":"There's an anecdote about curl, but I'm not sure if there's enough in here to draw conclusions from. 20% of vulnerabilities have been made public, and many of those are marked as \"withdrawn\" or \"duplicates\". However, it's unclear whether the remaining 80% have not been made public because they're not fixed or real. In other words, this is analysis of survivors (public); not much can be said about those still under embargo.","parent_id":50447074,"replies_count":3,"hn_url":"https://news.ycombinator.com/item?id=50447443"},{"id":50448708,"author":"sigmar","created_at":"2026-11-11T01:24:17.000Z","text":"> So far, only 2 of the 442 have been exploited in the wild, just 0.45%.\n> almost none are being exploited\nIsn't the whole point of glasswing to patch stuff way before it can be exploited? If the patched code is distributed quickly- there's no opportunity (or incentive) for bad actors to craft and distribute an exploit. This reads like an attempt to spin them as not being \"real\" vulnerabilities.","parent_id":50447074,"replies_count":2,"hn_url":"https://news.ycombinator.com/item?id=50448708"},{"id":50447517,"author":"delichon","created_at":"2026-11-10T22:59:55.000Z","text":"It is bad if this points to a general pattern of AI being better at finding than fixing vulnerabilities. The larger that ratio, the harder to secure all the things. The current stat from this experiment is 37,966 to 217. Lots of false positives, but not enough to change the big picture. I hope they didn't apply equivalent tokens to both sides, or AI may be better at demolition than construction.","parent_id":50447074,"replies_count":4,"hn_url":"https://news.ycombinator.com/item?id=50447517"},{"id":50448874,"author":"a34729t","created_at":"2026-11-11T01:48:37.000Z","text":"As someone downstream of the company in the posting, i can confirm the tsunami of AI generated vulnerability reports. And so thr human maintainers are stretched even thinner, and most of the bugs dont matter.\nThe good thing is the push towards an exploitability rating: If you have a vulnerable piece of software on your system, but it isnt running, it isnt critical.","parent_id":50447074,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50448874"},{"id":50448751,"author":"arlattimore","created_at":"2026-11-11T01:31:25.000Z","text":"The post seems misguided or misdirected in my opinion. Not discounting the fact that the frontier models may find existing bugs, that some are labelled at the incorrect level, even some being a non-bug -- fact remains they are discovering vast numbers of issues. It also isn't the job of Anthropic or OpenAI to fix everyone's bugs, they are doing everyone a courtesy to spend their time identifying them in the first place. The bigger issue appears to be that they are finding more bugs than the developer capacity to can address.","parent_id":50447074,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50448751"},{"id":50447495,"author":"hologramofham","created_at":"2026-11-10T22:58:17.000Z","text":"> Of Anthropic’s 37,966 reported findings, only 7,349 (19.4%) have been made public and just 217 have been marked fixed.\nSo the article is making a sweeping statement based on the 19.4% of publicly disclosed CVEs?\nThat statistic suggests the opposite. I'm sure government is aware of many back doors they keep secret and prefer them to remain secret.","parent_id":50447074,"replies_count":3,"hn_url":"https://news.ycombinator.com/item?id=50447495"},{"id":50448955,"author":"devy","created_at":"2026-11-11T02:02:21.000Z","text":"This is very much inline with Greg Kroah-Hartman the long-time Linux kernel maintainer's view Anthronpic's Mythos audacious claims its cyber capability. Majority of those \"findings\" were way out of proportion and merely \"pattern matching\" previously discovered methods of exploitation.\n[1] https://news.ycombinator.com/item?id=50342622\n[2] https://news.ycombinator.com/item?id=49929391","parent_id":50447074,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50448955"},{"id":50450831,"author":"kgeist","created_at":"2026-11-11T07:59:45.000Z","text":"Last week I deployed GLM-5.3-Flash on our on-premise servers, ran it against all repos, and in 6 hours it found 13 vulnerabilities across our products/sites, including 1 full account takeover and an RCE on our site which involved a pretty sophisticated chain of __destruct gadgets (all vulns verified to work by a human).\nAs an experiment, I also pointed it at the PHP runtime's source code, and it was able to construct PHP code that triggered a use-after-free (or a segfault, if you prefer DoS). I failed to find the vulnerability in the list of CVEs, so maybe it's a 0day, I don't know.\nSure, it's not a frontier model, but it can find many issues that were overlooked by all the commercial security scanners we run regularly as well. The nice thing about this setup is that we can run it 24/7 probing our code/infra, constructing exploits, etc. without having to care about token usage/bills. Plus, I think sending all that sensitive information about your internal infrastructure and the vulns found to Anthropic is a vulnerability in itself.","parent_id":50447074,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50450831"},{"id":50448528,"author":"eqvinox","created_at":"2026-11-11T01:02:49.000Z","text":"Does anyone know how Glasswing relates (quality-wise) to https://github.com/anthropics/oss-scanner ?","parent_id":50447074,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50448528"},{"id":50449803,"author":"gregjw","created_at":"2026-11-11T04:37:55.000Z","text":"Sankey diagrams are ruined for me","parent_id":50447074,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50449803"},{"id":50450405,"author":"lhk931122","created_at":"2026-11-11T06:50:31.000Z","text":"As AI gets better, it feels more and more like each person gets to hold a bomb in their own hand, but at the same time it feels like having a bomb that can just go off in that hand.","parent_id":50447074,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50450405"},{"id":50447959,"author":"greatgib","created_at":"2026-11-10T23:49:41.000Z","text":"In my opinion, what tells a lot about AI provider AGI claims versus reality is the difficulty to have LLM provide the fix to issues.\nFor PHP2shell vulnerability for example, there was \"patched\" .deb (and equivalent) packages only for the most recent and most trendy distributions but countless older versions of distributions and php versions were like abandoned without simple solution.\nI would have guess that \"patches\" and pre-built fixed packages would be flooding the world. And with just a prompt of one line, most servers would be properly patched. But no.","parent_id":50447074,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50447959"},{"id":50448424,"author":"kylestanfield","created_at":"2026-11-11T00:47:02.000Z","text":"There was a lot of hype early this year. Mythos, openclaw, gastown. And now they’re basically completely irrelevant. Things move so fast.","parent_id":50447074,"replies_count":1,"hn_url":"https://news.ycombinator.com/item?id=50448424"},{"id":50449379,"author":"manlymuppet","created_at":"2026-11-11T03:16:58.000Z","text":"Well in cases like these, it’s not the many that matter, but the few. Measuring in aggregate is not conclusive.","parent_id":50447074,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50449379"},{"id":50447507,"author":"jrflo","created_at":"2026-11-10T22:59:07.000Z","text":"Very interesting that the conclusion of the article is so tightly aligned with the VulnCheck's business model! It's almost as if this is just a thinly veiled advertisement...\n> The CVEs are a sliver of this year's total, almost none are being exploited, fixes have stalled while duplicates and withdrawals pile up, and the triage burden is shifting onto the open source maintainers Glasswing promised to help. The receipts keep coming in. They still don't reconcile.\n> VulnCheck is helping organizations not just to solve the vulnerability prioritization challenge - we’re working to help equip any product manager, CSIRT/PSIRT or SecOps team and Threat Hunting team to get faster and more accurate with infinite efficiency using VulnCheck solutions.","parent_id":50447074,"replies_count":0,"hn_url":"https://news.ycombinator.com/item?id=50447507"},{"id":50447420,"author":"fny","created_at":"2026-11-10T22:51:40.000Z","text":"I think the most obvious chicken little sign has been that we've had no catastrophic exploits in the past year due these findings.\nSure LLMs have helped reduce the attack surface and we patch things faster too, but I was really expected a few more Supermarket-level bangers.","parent_id":50447074,"replies_count":5,"hn_url":"https://news.ycombinator.com/item?id=50447420"}]}