Where Was Mythos When WordPress Fell?  🔗 **Source:** [Where Was Mythos When WordPress Fell?](https://patrik.re/where-was-mythos-when-wordpress-fell/) > [!note]+ Document Notes > --- > tags: [ai-security, wp2shell, vulnerability-research, ai-marketing-claims, maintainer-burden, wordpress-security] > author: [Patrik (patrik.re)] > source: [patrik.re] > reference: [https://patrik.re/where-was-mythos-when-wordpress-fell/] > date created: 2026-08-07 00:00 > --- > > [!info] Generated analysis — not the author's words. Sections below are machine-written > > from the captured source. Only text inside `> [!quote]` blocks is verbatim from the author. > > Do not quote or attribute any other line to the named author. > > [!warning] **Conflict of interest disclosure.** This analysis was generated by Claude, made by > > Anthropic — the company whose marketing claims this article criticises. Discount accordingly. > > I have tried to apply the same standard used on every other document in this batch: credit the > > strong reasoning, name the fallacies, and neither defend nor amplify. Where I judge a criticism > > sound I have said so plainly; where I judge an argument weak I have said that too, and you should > > weigh the second category more sceptically than the first given who is writing it. > # 🏷️ Title: Where was Mythos when WordPress fell? (patrik.re) > ## 🧭 Table of Contents > - [🔗 References](#-references) > - [📝 Summary](#-summary) > - [📖 Main Content](#-main-content) > - [📚 References](#-references-primary) > - [🗣️ Paraphrase](#️-paraphrase) > - [📰 Newsletter](#-newsletter) > - [✅ Action Items](#-action-items) > - [🧪 Hypotheses](#-hypotheses) > - [📊 Methodology](#-methodology) > - [❓ Questions](#-questions) > - [🔮 Future Research](#-future-research) > - [💡 Implications](#-implications) > - [🧠 Learning Styles Assessment](#-learning-styles-assessment) > - [📊 Accessibility Assessment](#-accessibility-assessment) > - [🌍 DEIB Assessment](#-deib-assessment) > - [✅ Logical Validity](#-logical-validity) > - [🛡️ DARVO Analysis](#️-darvo-analysis) > - [🎯 Conclusion](#-conclusion) > - [🧱 Refactor Appendix](#-refactor-appendix) > ### 🔗 References > - Article: https://patrik.re/where-was-mythos-when-wordpress-fell/ (published 2026-08-05, ~1,079 words) > - Anthropic update of 2026-05-22 (the source of the scanning figures) > - WordPress 7.0.2 release notes (reporter credits) > - Adam Kues / Searchlight Cyber — discoverer of the pre-auth WordPress core RCE ("wp2shell") > - Daniel Stenberg's curl evaluation · Bruce Schneier's commentary > - Cloudflare's published account of operationalising the model > ## 📝 Summary > - **What happened.** A sceptical audit of the gap between Anthropic's claims for its Mythos security model and the observable public record — prompted by the fact that a pre-auth RCE in WordPress core was found by a human researcher using a *different* model, not by the system marketed as "securing critical software for the AI era." > - **Why it matters for you specifically.** The methodology it describes — Adam Kues pointing an agent at a WordPress tree with git history stripped so it could not cheat by reading patches — **is the direct source of the agent code-analysis guardrails in your own `CLAUDE.md`**. This article is the critical context around that prompt. > - **Key stakeholders.** Open source maintainers receiving AI-generated vulnerability reports; security researchers; anyone evaluating AI security tooling claims; the WordPress security team. > - **Risks and tradeoffs.** The strongest material is quantitative and verifiable. The weakest is an argument from absence — that Anthropic's non-appearance in WordPress credits proves WordPress was not scanned, which does not strictly follow. > - **Bottom line.** The self-assessment critique and the maintainer-overload finding are sound and important. The framing question ("where were they?") is rhetorically effective and evidentially weaker than the numbers it sits alongside. > ## 📖 Main Content > - **The setup, with self-deprecation.** The author opens by disclaiming expertise — > [!quote] at the end of the day we prompt that API and hope something useful comes out of it — and describes a feed full of people certain "the Messiah had arrived and that cybersecurity was basically solved." > - **Programme context.** Mythos Preview was released to a limited set of trusted entities under **Project Glasswing**, with the stated aim of "securing critical software for the AI era." By June, the article states, the US government invoked export control powers and Anthropic shut off access to Fable 5 and Mythos 5 entirely. > - **The central question.** Anthropic's 22 May update said Mythos Preview had scanned > [!quote] more than 1,000 open-source projects, which collectively underpin much of the internet—and much of our own infrastructure. The author's challenge is simply: **which thousand?** If WordPress — running on hundreds of millions of sites — were among them, why did it not surface the pre-auth core RCE that Adam Kues subsequently found? > - **The pre-emption and the rebuttal.** He acknowledges the obvious defence — disclosed vulnerabilities are a lagging indicator, findings sit inside 90-day windows, not everything is publishable — and argues it does not cover this case, because the **WordPress 7.0.2 release notes credit the reporters and Anthropic is not among them**. > - **The numbers, read closely — the article's strongest section.** Of 23,019 total findings, 6,202 were rated high or critical, and > [!quote] those severity ratings are the model's own estimate of its own work. Of those 6,202, exactly **1,752 had been independently assessed** by a security firm at time of writing, and **a little over 60%** of the checked subset held up as high or critical. His summation: > [!quote] a model grading its own homework, and the part where somebody else marked the homework covered about a quarter of it. > - **What actually reached the public record.** Roughly **40 CVEs**, of which **28 are Firefox and 9 wolfSSL** — a browser and a cryptography library. > [!quote] There's no PHP in that list, no CMS, nothing that resembles the web most people actually use. > - **Independent evaluations.** Daniel Stenberg ran it against curl: five reported findings, one real, low severity, and a conclusion that the hype was "primarily marketing." Bruce Schneier is cited as arguing the common wisdom that Mythos is better than other models at finding vulnerabilities "is just not true." The author's framing: > [!quote] Two people with nothing to sell, saying so in public, months ago. Did it change anything at all? Not that I noticed. > - **The part that bothers him most — and the part that most corroborates other sources in this batch.** Around **530 high/critical bugs were reported to open source maintainers, of which 75 had been patched** at time of publication, and > [!quote] several maintainers told them they were so overloaded that they asked Anthropic to slow the disclosures down. His conclusion: securing critical software arrived "as a queue of tickets landing on unpaid volunteers who were already drowning." > - **Cloudflare's operational reality.** Testing against 50+ of their own repositories, a single agent session covers > [!quote] maybe a tenth of a percent of the surface in a useful way before the context window fills, so they built an **eight-stage pipeline** around the model to extract anything useful. > - **What Kues actually did — the methodological core.** Pointed GPT5.6 Sol Ultra at a **clean WordPress tree with git history stripped out so it could not cheat by reading patches**, capped it at four agents, and left it running. Ten hours later he had the exploit chain, at a cost of about **$25**. Kues' own conclusion, which the author endorses: no security researcher could have found and completed that chain in ten hours without AI. > - **The "20 minute experts."** After disclosure, AI-security companies raced to reverse-engineer wp2shell, some claiming their systems figured it out in twenty minutes. The author's retort is the article's rhetorical centre: **where were those systems before the bug was public?** He notes open source projects are the obvious free promotional playground, so their absence beforehand is telling. > - **The questions he ends on, unanswered by design.** Was it luck, or the prompt? Is it repeatable under the same conditions? > [!quote] Is steering the model eventually m  I am by no means an AI expert, and I get annoyed quickly by people who claim to be experts in the field, because let’s face it, at the end of the day we prompt that API and hope something useful comes out of it. When Anthropic announced the [infamous Mythos model](https://www.anthropic.com/research/mythos-preview) in spring of 2026 my entire feed on X was full of experts who were damn sure the Messiah had arrived and that cybersecurity was basically solved now. Anthropic released Mythos Preview to a handful of trusted entities under [Project Glasswing](https://www.anthropic.com/glasswing), with the ultimate goal of “securing critical software for the AI era”. By June the whole thing had escalated to the point where the US government [invoked export control powers](https://www.forbes.com/sites/anishasircar/2026/06/16/anthropic-disabled-fable-5-and-mythos-5-after-a-us-export-control-order-heres-what-happened/) and Anthropic shut off access to Fable 5 and Mythos 5 entirely. In an [update shared on 22nd of May](https://www.anthropic.com/research/glasswing-initial-update), Anthropic stated: “For the last few months, Anthropic has used Mythos Preview to scan more than 1,000 open-source projects, which collectively underpin much of the internet—and much of our own infrastructure.” Bold claims from the marketing department of Anthropic, leaving out one crucial aspect: which 1,000 projects were actually scanned by the almighty Mythos? Is it fair to assume that WordPress, that CMS from the 2000s that runs on roughly [hundreds of millions of websites](https://w3techs.com/technologies/details/cm-wordpress), wasn’t part of the open-source projects Anthropic looked at? Because surely it would’ve discovered the [pre-authentication RCE in WordPress Core](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core) found by my colleague [Adam Kues](https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6) from Searchlight Cyber, right? Anthropic will tell you that disclosed vulnerabilities are a lagging indicator, that they sit inside a 90 day window and can’t publish everything yet, and that’s a fair point to make. It just doesn’t cover this one. The [WordPress 7.0.2 release notes](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/) credit the people who reported it, and Anthropic isn’t among them. #### The numbers, if you read them If you actually read [the update](https://www.anthropic.com/research/glasswing-initial-update), the numbers don’t quite add up. Mythos Preview found what Anthropic describes as 6,202 high or critical severity vulnerabilities out of 23,019 in total, and those severity ratings are the model’s own estimate of its own work. Of those 6,202, exactly 1,752 had been assessed by an independent security firm at the time of writing, and of the ones that got checked, a little over 60 percent held up as high or critical. So the number that kept popping up in my feed was a model grading its own homework, and the part where somebody else marked the homework covered about a quarter of it. Would you put that number in a press release? Then there’s the question of what came out the other end. If you go looking for the public record of what Mythos actually found you land on [roughly 40 CVEs](https://www.vulncheck.com/blog/anthropic-glasswing-cves), and 28 of those are Firefox and 9 of them are wolfSSL. A browser and a cryptography library. There’s no PHP in that list, no CMS, nothing that resembles the web most people actually use. Which brings me back to the same question: which 1,000 projects? #### Some people actually checked The people who did get their hands on it were nowhere near as excited as my timeline. Daniel Stenberg [ran it against curl](https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/) and got five reported findings, of which exactly one turned out to be a real vulnerability, and it was low severity, and his conclusion was that the hype around the model was “primarily marketing”. Bruce Schneier [argues](https://www.schneier.com/blog/archives/2026/06/anthropics-project-glasswing-update.html) that it had become common wisdom that Mythos is better at finding software vulnerabilities than other models, “which is just not true.” Two people with nothing to sell, saying so in public, months ago. Did it change anything at all? Not that I noticed. #### Securing critical software, in practice And then there’s the part that bothers me the most. Anthropic [reported around 530 high or critical bugs](https://www.anthropic.com/research/glasswing-initial-update) to open source maintainers, of which 75 had been patched by the time they published that update, and several maintainers told them they were so overloaded that they asked Anthropic to slow the disclosures down. So securing critical software for the AI era arrived, in practice, as a queue of tickets landing on unpaid volunteers who were already drowning. Cloudflare [published an account](https://blog.cloudflare.com/cyber-frontier-models/) of what running this thing actually looks like. They tested it against more than fifty of their own repositories and found that a single agent session covers, in their words, “maybe a tenth of a percent of the surface in a useful way” before the context window fills up, so they ended up building an eight stage pipeline around the model to get anything worth reading out of it. What Adam did, for the record, was point GPT5.6 Sol Ultra at a clean WordPress tree with the git history stripped out so it couldn’t cheat by reading patches, cap it at four agents, and leave it running. Ten hours later he had the chain, and it cost him about 25 dollars. His own conclusion is that no security researcher could have found and completed that exploit chain in ten hours without AI, and I believe him, which is exactly why the rest of this bothers me. #### Enter the 20 minute experts In the aftermath of this disclosure, what would become dubbed wp2shell, the race of “AI Security” companies started to reverse what the bug is and how it works. Some claimed their AI figured it out in 20 minutes. Impressive. Now the question I ask myself is where were those projects, models and promises of a secure internet when open source projects like WordPress needed it most? I am sure that since the dawn of capable models like Claude and GPT someone has thrown the WordPress git repository at one of them before, maybe even [XBOW](https://xbow.com)? Aren’t those open source projects the perfect playground for promotion? If we assume that, probably, maybe, an embarrassingly large amount of individuals tried exactly what Adam did and failed, wouldn’t it be fair to start asking questions on why? Was it sheer luck? The prompt? Can the same achievement be repeated under the same circumstances? If not, what does that tell us about the “capabilities” of our frontier models? Is Mythos that dangerously “good”? Are we collectively being blinded by clever marketing campaigns? Is steering the model eventually more important than advertised capabilities? I don’t have any answers for those questions, but what I do know is that a lot of influential people in this industry blindly follow marketing claims., Where Was Mythos When WordPress Fell?, patrik.re, 01kze6zd3wx523cc7ypqm0514n.