Greg Kroah-Hartman on LLM Security Claims: Mythos Bug Findings Deconstructed

Takeaway

Greg Kroah‑Hartman exposed that Anthropic’s Mythos "found" 79 Linux kernel vulnerabilities, yet 24 had no details, 14 were not bugs, 3 were fabricated, and many were already fixed – the entire effort boiled down to about an hour of kernel work. This undercuts the hype around LLM‑driven security and shows why human review remains essential.

Mythos’ Bug Count Is Misleading

Conclusion: The headline “79 vulnerabilities” is misleading because most entries were either non‑issues or already resolved.

24 entries provided no technical detail, described only as “something crashed.”
14 entries were not bugs at all.
3 entries were completely fabricated.
15 entries had already been fixed in the latest kernel release.
11 entries were fixes contributed by other developers, not Mythos.
4 entries originated from Anthropic’s own code.
Remaining items were minor or trivial (e.g., assumptions about malicious filesystem images, network packet injection, or niche networking stacks).

Greg labeled the genuine, novel fixes as “10 ‘real’ bug‑fixes,” emphasizing how the bulk of the list was noise.

"Mythos's 79 vulnerabilities: 24 – no detail at all … 3 – totally made up data … 15 – already fixed in latest release" – usernomdeguerre (HN comment)

The Speed of the Fixes Shows Limited Value

Conclusion: The entire set of “real” fixes required roughly one hour of kernel development, demonstrating that the LLM did not provide a substantial productivity boost.

Multiple commenters noted that the work boiled down to one hour of kernel development.
This rapid turnaround suggests that the majority of the reported issues were either trivial to fix or already addressed.

"He also said that it all boiled down to just one hour of kernel development work." – sriram_sun (HN comment)

LLMs Are Still “Fuzzy Pattern Matchers”

Conclusion: Greg repeatedly described LLMs as pattern‑matching tools, not true reasoning engines, reinforcing the need for expert human validation.

He criticized the term hallucinate as anthropomorphizing the technology.
The talk highlighted that LLMs perform static code analysis akin to existing tools, offering no novel security insight.

"He refers to LLMs as nothing more than 'fuzzy pattern matching'… He does not like the term 'hallucinate' as it anthropomorphises a computer." – 1vuio0pswjnm7 (HN comment)

Legal and Ethical Concerns Remain Unresolved

Conclusion: The discussion raised unanswered legal questions about using copyrighted code in LLM training, with the Linux community taking a hands‑off stance.

Greg quoted LG Research stating that only 20 % of the training corpus is legally permissible.
He deferred to the courts on the legality of using LLM‑generated code that mirrors copyrighted material.
No concrete Linux‑project policy was cited, indicating a gap in governance.

"Common corpus contains only 20% legally allowed‑to‑be‑used data… We'll let the courts deal with that." – tombh (HN comment)

Community Reactions Highlight Skepticism

Conclusion: Hacker News commenters largely view Mythos as overhyped and stress the importance of human expertise.

Overhype: Several users called Mythos “overrated” and “overhyped.”
Human Review: Comments emphasized that humans remain critical for sustainable software security.
Tool Synergy: Some suggested that specialized LLMs could assist with triage if paired with rigorous validation pipelines.

"Finally it is official. Mythos was overhyped and overrated." – 1sgT15 (HN comment)

Why This Matters

The episode underscores a broader pattern: LLM vendors may exaggerate security capabilities to gain trust, while the actual utility for complex, safety‑critical codebases like the Linux kernel is limited. Developers and security teams should treat LLM‑generated findings as initial signals, not definitive vulnerabilities, and allocate resources to thorough human verification.

Lessons for Practitioners

Treat LLM bug reports as low‑confidence alerts. Verify each claim against the codebase and existing CVE databases.
Maintain rigorous patch attribution. Credit original developers; avoid attributing fixes to the LLM.
Develop internal validation models. Pair LLMs with static analysis and triage tools to filter false positives.
Stay informed on legal developments. Monitor court cases and policy discussions about copyrighted training data.
Communicate transparently. When publishing LLM‑derived security findings, disclose the methodology and confidence levels.

Bottom Line

Greg Kroah‑Hartman’s analysis shows that Anthropic’s Mythos did not deliver a breakthrough in kernel security; most reported bugs were trivial, already fixed, or fabricated. The episode serves as a cautionary tale against uncritical acceptance of LLM‑driven security claims and reinforces the enduring need for expert human oversight.