Greg Kroah-Hartman debunks AI security hype: 79 vulnerabilities, only 10 real
Greg Kroah-Hartman – Security in the LLM Age [video]
In a Kernel Recipes 2026 talk, Greg Kroah-Hartman dissected 79 vulnerabilities reported by an AI model. Most were noise: 24 lacked detail, 14 weren't bugs, 3 were fabricated, and 15 were already fixed. Only 10 were genuine fixes. He warns against uncritical parroting of AI security press releases.
GHK called this "10 'real' bugfixes", which to me sounds like there's a wild hype machine around these companies and uncritical parroting of every press release they make that falls apart when you engage the affected real experts.
- usernomdeguerre
Greatly appreciated the candor. I've included a few slides into text that i thought were eye-opening to me:
From his Kernel Recipes 2026 slide on Mythos
```
Mythos's 79 vulnerabilities:
24 - no detail at all "something crashed"
14 - not a bug at all
3 - totally made up data
15 - already fixed in latest release
- 11 by others
- 4 by anthropic
20 - fixes were needed
- 7 "assume a malicious filesystem image"
- 2 "assume you can inject a malicious network packet into the middle of the stack"
- 2 "NOMMU"
- 6 sctp networking issues for untrusted devices
- 2 ipv6 minor network issues
- 1 gpu driver for local malicious user
```
GHK called this "10 'real' bugfixes", which to me sounds like there's a wild hype machine around these companies and uncritical parroting of every press release they make that falls apart when you engage the affected real experts.
- devy
At 3m19s Greg KH revealed what Mythos did in "revealing" 79 CVEs - pure pattern matching the previous decades of kernel developer's patches, and applying those mechanisms elsewhere to see if they have been universally patched. And Anthropic didn't cite Kernel Developers who original fixed/patched the CVEs like a decent human being would do. So yeah, Anthropic has the same problem OpenAI had for citing original work.
- sriram_sun
He also said that it all boiled down to just one hour of kernel development work.