14 Apr 2026 Search

AI bug reports, so hot right now. See A flood of useful security reports by Daroc Alden. This is not just a Claude Mythos thing. Claude Code Found a Linux Vulnerability Hidden for 23 Years. Also not just an Anthropic thing. Sashiko, which is generating useful info on kernel bugs, uses Google’s Gemini. See What’s Actually in a Sashiko Review? by Brian “bex” Exelbierd. Small models also found the vulnerabilities that Mythos found by Stanislav Fort. This points to a more nuanced picture than one model changed everything. See also Three reasons to think that the Claude Mythos announcement from Anthropic was overblown by Gary Marcus.

Greg Kroah-Hartman told Steven J. Vaughan-Nichols that as of about a month ago, AI bug reports are not just slop. Now we have real reports. All open-source projects have real reports that are made with AI, but they’re good, and they’re real. All open source security teams are hitting this right now. (More: AI bug reports went from junk to legit overnight, says Linux kernel czar) And Thomas Ptacek writes, Vulnerability research is cooked.

Vulnerabilities are found by pattern-matching bug classes and constraint-solving for reachability and exploitability. Precisely the implicit search problems that LLMs are most gifted at solving. Exploit outcomes are straightforwardly testable success/failure trials. An agent never gets bored and will search forever if you tell it to.

Even if you believe that the LLMs will eventually be able to fix security issues in an automated or semi-automated way, there’s still a period of time coming up when much more human bug fixing will be needed to deal with the “flood.” Any codebase (open source or proprietary) comes with a short position in maintenance programmers, and all this LLM bug report news means the short squeeze is on.

How dangerous is Anthropic’s Mythos AI? | Bruce Schneier