Stenberg says seven of Anthropic’s latest 45 curl findings are confirmed low-severity vulnerabilities

On 10 November, curl lead developer Daniel Stenberg put a number on Anthropic’s latest batch of reports: seven confirmed low-severity vulnerabilities, 37 he classed as “just a bug”, and one he called completely false. He had posted the 45 reports as public GitHub issues the day before.

Minutes earlier, he had also said the project is “gradually raising the bar for what we accept as LOW severity” curl vulnerabilities. None of this latest batch has been called medium or high in his posts, and no CVE identifiers for them have been published yet. The confirmed issues remain in the project’s public tracker, where curl now handles low- and medium-severity reports in the open.

International Cyber Digest circulated those numbers on 11 November, with a screenshot of Stenberg’s Mastodon posts. That recap called the source Mythos and described curl as a tool “inside billions of devices.” Stenberg’s own posts do not use the name Mythos for this batch. They call it “Anthropic’s latest 45 findings,” and the GitHub issues themselves are labelled as reports forwarded from Anthropic’s OSS Scanner.

‼️ Mythos flagged 45 security findings in curl, the tool inside billions of devices. So far only 7 are confirmed vulnerabilities, all rated low.

curl’s lead developer Daniel Stenberg says 37 are “just a bug” and one is completely false. pic.x.com/4hPTQlJo8x

— International Cyber Digest (@IntCyberDigest) November 11, 2026

What is on the public list

The 45 issues are collected under a GitHub search for ANT-2026. Stenberg wrote on 9 November that these were the findings Anthropic reported to curl “last week.” Several of the tickets still carry a “[vuln]” title from the original report even where the curl security team has later labelled them as not a vulnerability. This article does not repeat those unconfirmed titles as security flaws.

This November batch is separate from an earlier Mythos scan of curl that Stenberg wrote about in May. In that first report, the model called five issues “confirmed security vulnerabilities.” After the curl security team reviewed them, Stenberg said only one stood as a vulnerability. He wrote then that it would be a low-severity CVE, planned for publication with curl 8.21.0 in late June. Three were false positives already covered in API documentation, and one was treated as an ordinary bug.

What is not being claimed

There is no public statement from the curl project that these latest findings are being exploited, and Stenberg’s classification puts most of the batch outside the vulnerability process altogether. The seven he has confirmed are all low severity, on a bar he says the project is still raising. Details, severity labels and any later CVE assignments should be taken from the public issues and from curl’s own security advisories when those are published, not from the first pass of an automated report.