AI bug‑hunters are overhyped

A public test of Anthropic's Mythos against the cURL codebase produced only one low‑severity confirmed vulnerability after manual triage, suggesting that current 'AI bug‑hunter' products may not materially outperform existing code‑analysis tools. The result raises questions about relying on vendor reports, the gap between marketing claims and operational security value, and how open‑source projects are enrolled in promotional programs. — If replicated, this pattern undermines procurement and trust in AI security tools and argues for independent validation before firms or governments rely on marketed automated vulnerability scanners.