Re:After 7 Months, Glasswing Overwelms Maintainers with Unde...
by DeepFuzz on Wednesday November 11, 2026 @09:19AM
(#50453733)
Also work at a big tech company that has fixed many thousands of triaged/verified security issues found by Mythos which would never show up in CVE reports/blogs.
My understanding is that few have been critical vulnerabilities on their own, but LLMs are now able to piece together 10+ less critical vulnerabilities to create a critical exploit. So, some of the classic triage practices that rely on standalone CVSS scores should be coming into question.
Even if you have just have 1,000 low severity vulnerabilities today that don't add up to something critical, they might add up to something critical when the next model generation arrives, so you need to get ahead of those latent vulnerabilities. The safest approach is to fix everything, which is understandably difficult for OSS.
If that isn't possible, then we need new ways of prioritizing/triaging bugs... which would also make for a more interesting blog post than claiming Mythos is 'underwhelming'.
My understanding is that few have been critical vulnerabilities on their own, but LLMs are now able to piece together 10+ less critical vulnerabilities to create a critical exploit. So, some of the classic triage practices that rely on standalone CVSS scores should be coming into question.
Even if you have just have 1,000 low severity vulnerabilities today that don't add up to something critical, they might add up to something critical when the next model generation arrives, so you need to get ahead of those latent vulnerabilities. The safest approach is to fix everything, which is understandably difficult for OSS.
If that isn't possible, then we need new ways of prioritizing/triaging bugs... which would also make for a more interesting blog post than claiming Mythos is 'underwhelming'.