Want to wade into the sandy surf of the abyss? Have a sneer percolating in your system but not enough time/energy to make a whole post about it? Go forth and be mid.
Welcome to the Stubsack, your first port of call for learning fresh Awful youāll near-instantly regret.
Any awful.systems sub may be subsneered in this subthread, techtakes or no.
If your sneer seems higher quality than you thought, feel free to cutānāpaste it into its own post ā thereās no quota for posting and the bar really isnāt that high.
The post Xitter web has spawned so many āesotericā right wing freaks, but thereās no appropriate sneer-space for them. Iām talking redscare-ish, reality challenged āculture criticsā who write about everything but understand nothing. Iām talking about reply-guys who make the same 6 tweets about the same 3 subjects. Theyāre inescapable at this point, yet I donāt see them mocked (as much as they should be)
Like, there was one dude a while back who insisted that women couldnāt be surgeons because they didnāt believe in the moon or in stars? I think each and every one of these guys is uniquely fucked up and if I canāt escape them, I would love to sneer at them.
(Credit and/or blame to David Gerard for starting this.)
In the latest episode of ābehold the power of Mythosā from The Hacker News - Claude Mythos AI Finds 10,000 High-Severity Flaws in Widely Used Software
I distilled it so you donāt have to.
That 10,000 count didnāt even survive until paragraph 3.
Ah fuck. 1726. But wait, a bad infographic has entered the ring!
Ok now weāre talking.
Wait, what? Why those? Why only those?
You couldnāt even cherry pick the valid ones?
Where did the other 1259 go? Maybe this other part of the flowchart will go betterā¦
Most of them just spammed at open source maintainers. Right. Maybe Anthropicās media release has the goods!
Slightly lower than the 1900, but ok, whatever.
1587 is lower than the infographicās 1726 confirmed positivesā¦ But 10% of 10000 high sev is still something, right?
Iām sure those maintainers enjoyed that 16% high+ sec rate based on Mythosā own estimations. But wasnāt that 1129 the bulk of your reports?
530 is only a third of the reports you made to maintainersā¦
The infographic says 88.
Iād ask if they were massaging their financials like they massaged 65 advisories, but we know they are.
23,019 potential vulnerability candidates of all severities, 65 advisories. If you printed the code out and drunkenly threw darts at it youād probably hit the same level of accuracy.
All that it tells me is that if you spent the same amount of resources on just fuzzing randomly picked OSS codebases youād probably get better value for your buck.
Iāve seen a handful of security people claim different kinds of yields with some of this shit. I havenāt gone to read up in depth but I wouldnāt be too surprised a lot of them run around with unstated assumptions/provisos in their thonkposts (this shit is expensive (for research volume) and only some people can afford the science experiments)
Got a list of a couple of names Iām keeping an eye on as the first tokenprice-pocalypse (that needs a better word) takes place
Vibenarok
ooh, brava!
Eschatoken
Perfection
Anthropic (who own Claude Code) are hoping to IPO this year.
it continues to be amazing to me that this is the āhigh impactā area theyāre going with: even if their analysis systems are better (and frankly I still donāt buy this wholesale, thereās a whole rest of the owl being handwaved[0]), but-elimination is by definition diminishing returns so you can only fanfare like this the first time
[0] - having fucking gigantic budgets to throw at running a parse of every single repo and every test condition/simulation you wish to certainly does help a hell of a lot, even moreso when you can shell out to a half-dozen second stage review corpsā¦
I honestly canāt think of anywhere else they can go with it. They need:
Code security review is probably the only way you can realistically achieve all four. But theyāre not even coming close. Not even with access to āpartnerā black box repositories coupled with under-resourced open source packages.
And they know theyāre not succeeding, because they wouldnāt bury that 530 high+ sev number deep in the middle of the press release if they thought it were impressive.
Luckily for them, the slop ānewsā blogs will parrot numbers like 10k, and their only strength - model collapse as a marketing strategy - can handwave the rest of that owl.
So whatās the over/under on the discrepancies between the numbers that the HN folks got and the official press release numbers being in part due to some kind of hallucinatron hijinks? Because Iām gonna go ahead and predict with confidence that either the HN post was written with a faulty slopbot and they didnāt check it or else the presser itself went through the matrix-multiplication-meaning-mangler. Possibly both and all those numbers are similar levels of āmore or less right, we swearā
Itās almost certainly a slop article, but to its credit, it did accurately cite the numbers from the official Anthropic flowchart image. (Also, just to be clear, this is an Indian ā#1 cybersecurity newsā company doing an SEO piggyback off the orange site, not the orange site itself).
However, Anthropicās numbers in their official post do not match their own flowchart, despite being presented together. My assumption is they made the image, post, and yet another fucking dashboard earlier, then failed to keep them all in sync when someone revised the numbers up or down.
The dashboard timestamp claims itās showing the latest numbers as of 2026-05-22 10:27 PT (T17:27Z) with values that match the numbers in the image. The post created timestamp gives 2026-05-20 T14:07:48Z, and it was later updated at 2026-05-22 T20:37:40Z. Iām guessing that update was to swap the image, and the fact that some of the values are also quoted in the text was completely overlooked. Or vice versa.
Itās the kind of attention to detail Iāve come to expect from Anthropic.