Top all-time · #1020
Anthropic
Company blog · red.anthropic.comsecurityai
Anthropic is the company blog at red.anthropic.com, writing about security and ai. Since 2025, 67 different Hacker News readers have linked it 75 times, most often “Assessing Claude Mythos Preview's cybersecurity capabilities”. No feed was found, so read it on the site itself.
Rarely recommended · 1 of 40 sampled comments recommend it, 3 are critical?
Why HN links it
HN readers link Anthropic's Frontier Red Team posts on AI-found vulnerabilities, such as the Mythos Preview, zero-day and Glasswing reports. Commenters often quote them while debating how far the claims hold up.
- Recommended for · 1 comments
- One commenter says the nginx WebDAV write-up is exactly what they searched for and wanted to read.1
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Anthropic is an AI safety and research company that's working to build reliable, interpretable, and steerable AI systems.
Most-linked posts?
- Assessing Claude Mythos Preview's cybersecurity capabilities22 people · 26 mentions · first linked 2026-04-07
- 0-Days \ Red.anthropic.com11 people · 11 mentions · first linked 2026-02-05
- Measuring LLMs' impact on N-day exploits5 people · 5 mentions · first linked 2026-06-08
- red.anthropic.com5 people · 5 mentions · first linked 2025-08-10
- Anthropic's coordinated vulnerability disclosure dashboard4 people · 5 mentions · first linked 2026-05-22
- OSS Scanner4 people · 4 mentions · first linked 2026-10-08
- Measuring LLMs' ability to develop exploits3 people · 3 mentions · first linked 2026-05-22
- Reverse engineering Claude's CVE-2026-2796 exploit2 people · 2 mentions · first linked 2026-03-06
- Mapping AI-Enabled Cyber Threats: Insights from the LLM ATT&CK Navigator2 people · 2 mentions · first linked 2026-06-03
- AI agents find $4.6M in blockchain smart contract exploits2 people · 2 mentions · first linked 2025-12-01
What Hacker News says?
> Since then, this weakness has been missed by every fuzzer and human who has reviewed the code, and points to the qualitative difference that advanced language models provide. [^1] > At no point in time does the program take some easy-to-identify action that should be prohibited, and so tools like fuzzers can’t easily identify such weaknesses. [^2] [^1]: https://red.anthropic.com/2026/mythos-preview/#:~:text=Since.…
Comment linking /2026/mythos-preview/
on “Project Glasswing: Securing critical software for the AI era”Submitted AI agents find $4.6M in blockchain smart contract exploits as a story · 215 points
HN discussionIt feels to me full with marketing in the guise of trying to save the world from their own making. "we have a model so strong we can't release it, here are all the details of why it's so good, but don't ask for access, you can't get it, it's too risky for your own good" Something smells really really weird: 1. Per the blog post[0]: "This was the most critical vulnerability we discovered in OpenBSD with Mythos Previe…
Comment linking /2026/mythos-preview/
on “Project Glasswing: Securing critical software for the AI era”Submitted Assessing Claude Mythos Preview's cybersecurity capabilities as a story · 48 points
HN discussionFew thoughts 1. Per the blog post[0]: "This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings" Since they said it was patched, I tried to find the CVE, it looks like Mythos indeed found a 27 years old OpenBSD bug (fantastic), bu…
Comment linking /2026/mythos-preview/
on “Project Glasswing: Securing critical software for the AI era”Submitted OSS Scanner as a story · 6 points
HN discussionThey specifically mention "H.264, H.265, and av1 codecs, along with many others" here https://red.anthropic.com/2026/mythos-preview/
Comment linking /2026/mythos-preview/
on “Project Glasswing: Securing critical software for the AI era”Submitted red.anthropic.com as a story · 6 points
HN discussionI guess so, but there's a ton of buffer overflow vulnerabilities in the wild, and ostensibly it wasn't detected by static analysis The red team post goes over some more impressive finds, and says that there's hundreds more they can't disclose yet: https://red.anthropic.com/2026/mythos-preview/
Comment linking /2026/mythos-preview/
on “Project Glasswing: Securing critical software for the AI era”Submitted OSS Scanner as a story · 5 points
HN discussionFrom the red team post https://red.anthropic.com/2026/mythos-preview/ "Most security tooling has historically benefitted defenders more than attackers. When the first software fuzzers were deployed at large scale, there were concerns they might enable attackers to identify vulnerabilities at an increased rate. And they did. But modern fuzzers like AFL are now a critical component of the security ecosystem: projects…
Comment linking /2026/mythos-preview/
on “Project Glasswing: Securing critical software for the AI era”Submitted OSS Scanner by Anthropic as a story · 4 points
HN discussion- The OpenBSD one is 'TCP packets with invalid SACK options could crash the kernel' https://cdn.openbsd.org/pub/OpenBSD/patches/7.8/common/025_s... - One (patched) Linux kernel bug is 'UaF when sys_futex_requeue() is used with different flags' https://github.com/torvalds/linux/commit/e2f78c7ec1655fedd94... These links are from the more-detailed 'Assessing Claude Mythos Preview’s cybersecurity capabilities' post rele…
Comment linking /2026/mythos-preview/
on “Project Glasswing: Securing critical software for the AI era”Submitted Mapping AI-Enabled Cyber Threats: Insights from the LLM ATT&CK Navigator as a story · 3 points
HN discussionAFAIK, Antropic claims that they weren't aiming for zero-days specifically. From https://red.anthropic.com/2026/mythos-preview/ : We did not explicitly train Mythos Preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy. The same improvements that make the model substantially more effective at patching vulnerabilities also make it…
Comment linking /2026/mythos-preview/
on “Claude Opus 4.8”Submitted Anthropic has a Red Team page as a story · 3 points
HN discussionsome of the bench marks i have seen on also include cost where one scan of the codebase cost tens of thousands of dollars. this one [0] notes one run cost $20k to run but another cost $50. [0] https://red.anthropic.com/2026/mythos-preview/
Comment linking /2026/mythos-preview/
on “Claude Opus 4.8”Submitted 0-Days \ Red.anthropic.com as a story · 3 points
HN discussionThey are doing that too. https://red.anthropic.com/2026/zero-days/
Comment linking /2026/zero-days/
on “We tasked Opus 4.6 using agent teams to build a C Compiler”Submitted OSS Scanner as a story · 2 points
HN discussion> This was the most critical vulnerability we discovered in OpenBSD with Mythos Preview after a thousand runs through our scaffold. Across a thousand runs through our scaffold, the total cost was under $20,000 and found several dozen more findings. Anthropic did that for OpenBSD. https://red.anthropic.com/2026/mythos-preview/
Comment linking /2026/mythos-preview/
on “OpenBSD 7.9 Released”Submitted Measuring LLMs' impact on N-day exploits as a story · 2 points
HN discussionNot precisely, but we have a good idea of what it would be, from the Mythos Red Team report [1] > For all of the bugs we discuss below, we used the same simple agentic scaffold of our prior vulnerability-finding exercises. > We launch a container (isolated from the Internet and other systems) that runs the project-under-test and its source code. We then invoke Claude Code with Mythos Preview, and prompt it with a pa…
Comment linking /2026/mythos-preview/
on “We Reproduced Anthropic's Mythos Findings with Public Models”Submitted Mapping AI-enabled cyber threats: Insights from the LLM ATT&CK Navigator as a story · 2 points
HN discussionAlso, a lot of them talk about finding the same vulns -- and not about writing exploits for them, which is where Mythos is supposed to be a real step up. Quoting Anthropic's blog post: "For example, Opus 4.6 turned the vulnerabilities it had found in Mozilla’s Firefox 147 JavaScript engine—all patched in Firefox 148—into JavaScript shell exploits only two times out of several hundred attempts. We re-ran this experim…
Comment linking /2026/mythos-preview/
on “We Reproduced Anthropic's Mythos Findings with Public Models”Submitted Measuring LLMs' ability to develop exploits as a story · 2 points
HN discussion> Anthropic has also admitted that the bugs found by Mythos had not been found by using a prompt like "find the bugs", but by running many times Mythos on each file with increasingly more specific prompts, until the final run that requested only a confirmation of the bug, not searching for it. Unless there's been more information since their original post ( https://red.anthropic.com/2026/mythos-preview/ ), this is a…
Comment linking /2026/mythos-preview/
on “Qwen3.6-35B-A3B: Agentic Coding Power, Now Open to All”Submitted Anthropic's coordinated vulnerability disclosure dashboard as a story · 2 points
HN discussionThe official release by Anthropic is very light on concrete information [0], only contains a select and very brief number of examples and lacks history, context, etc. making it very hard to gleam any reliably information from this. I hope they'll release a proper report on this experiment, as it stands it is impossible to say how much of this are actual, tangible flaws versus the unfortunately ever growing misguided…
Comment linking /2026/zero-days/
on “Anthropic's Claude Opus 4.6 uncovers 500 zero-day flaws in open-source code”Submitted Measuring LLMs' ability to develop exploits as a story · 2 points
HN discussion
