Curl trims Mythos scan to one flaw

Mythos looks more like a strong triage assistant than a magic vulnerability oracle. On curl, a famously over-audited codebase, it still found real issues, but the human review mattered more than the model’s confidence.

• –Five claimed vulns collapsed to one confirmed low-severity CVE, which is a good reminder that “confirmed” from a model is not the same as confirmed by maintainers
• –The report still yielded roughly 20 bugs worth investigating, so the scan had value even with heavy false-positive decay
• –curl is an unusually hard benchmark: heavily fuzzed, widely audited, and already scanned by other AI tools, so this is a useful stress test for the category
• –The takeaway is practical, not hype-driven: AI can broaden security coverage, but only expert review can separate exploitable flaws from documented behavior and plain bugs
• –The planned fix lands with curl 8.21.0 in late June, which makes this a real security follow-up rather than just a lab demo