An AI agent found a real vulnerability in curl
Mythos, an autonomous security agent, caught a buffer overflow in curl that human auditors missed. The tooling works.
An LLM-based security agent called Mythos just found a legitimate vulnerability in curl. Not a theoretical weakness. A real buffer overflow that could crash the process. Daniel Stenberg, curl’s maintainer, confirmed it. CVE assigned. Patch shipped. The agent did what it was supposed to do. What makes this interesting is not that AI can find bugs. Static analysers have done that for decades. It is that Mythos operates autonomously. It reads code, spots patterns, generates proof-of-concept inputs, and files reports without a human steering every step. The loop closed itself. Curl has been audited repeatedly. Fuzzing runs constantly. This bug still slipped through. Mythos caught it because it approached the code differently. LLMs are decent pattern matchers when the domain is constrained and the feedback loop is tight. Security tooling is exactly that. The worry is not whether agents can find bugs. They can. The worry is signal-to-noise. If Mythos files ten reports and nine are false positives, maintainers will ignore all ten. Stenberg did not mention how many other reports he received before this one landed. That ratio matters more than the single success. Still, this is the first time I have seen an LLM agent get credit in a CVE disclosure. The tooling is crossing the threshold from demo to useful. If the false positive rate stays low, this becomes standard infrastructure. Every open source project gets an agent watching the repo, filing issues when something smells wrong. I would not bet against that happening within two years.