The other day the news reported that the Symfony developers had fixed 19 vulnerabilities found by the Claude Mythos Preview model. What's especially interesting:
A few days later, and following Symfony's security disclosure process, we received a ZIP file with all their findings. In total, Claude Mythos reported 19 security vulnerabilities in Symfony and Twig codebases. The Symfony Core Team reviewed every report manually, and all 19 findings turned out to be real vulnerabilities, with no false positives.
Not a single false positive.
I've come across AI security reports on various web projects before. Usually colleagues, or even clients, sent them over to review and fix. Back then those reports consisted of false positives just a little less than entirely. But even so, the time spent going through a report was worth it: behind 20 “fake” vulnerabilities there were one, two or three real ones. Which is cool in itself, because now you don't have to hunt for them yourself — you just need to filter out all the junk from the report.
And here — almost two dozen confirmed holes and not a single mistake. And although Claude Mythos Preview isn't available to every commoner yet — it's in closed testing — this is apparently a successful success.
What can I say. These days you need to pay close, even closer attention to regularly updating your software, packages and frameworks. Claude Mythos Preview may not be available to everyone, but anyone can already scan a program's code for vulnerabilities with Claude Code. And nobody asks about your intentions at the door.
And it can find vulnerabilities too: XSS, leaked API tokens, IDORs of all sorts, Lord forgive me. So as long as you have a tool to search with, a hole will turn up. As the classic told us, There is a crack in everything. That's how the light gets in.
Let's stay vigilant.