The AI industry is running a contradiction it hasn’t resolved.

Frontier labs are warning about an imminent software security collapse. Anthropic reported that Claude Mythos found zero-days in codebases hardened by decades of review: a 27-year-old denial-of-service bug in OpenBSD’s TCP SACK implementation, and a 17-year-old remote code execution flaw in FreeBSD’s NFS server that hands an unauthenticated user root (CVE-2026-4747). Mozilla, testing Mythos Preview against Firefox 150, surfaced 271 vulnerabilities, more than ten times what it found in Firefox 148 using Claude Opus 4.6. OpenAI is sounding the exact same alarm, touting GPT-6 Astra saturating ExploitBench while warning that autonomous attack capabilities are scaling faster than human defenders can patch.

To be fair, Anthropic acted on part of this. Project Glasswing puts $100M in credits behind partnerships with Microsoft, Apple, CrowdStrike, and the Linux Foundation.

Glasswing makes sense for foundational open-source packages and mega-cap infrastructure. It does nothing for the other 99% of software developers. The startups, the internal tool builders, and the mid-market engineering teams writing the proprietary software that runs the rest of the world don’t have an organizational sponsor. Yet they are expected to hold off machine-speed exploits without access to the intelligence that found them.

What they get instead are models like Claude Fable or public endpoints of Astra, sitting behind hair-trigger safety classifiers and preemptive capability caps.

Labs are terrified of prompt injection and “I’m an authorized pen tester” jailbreaks, so the filters cast an absurdly wide net. Paste in complex code and ask the model to trace an execution path, analyze memory corruption, or check whether untrusted input can reach a sensitive sink, and the classifier fires immediately.

Security researchers have already documented Claude Code blocking vulnerability work outright, throwing errors about “violative cyber content” that contaminate the entire session and spread to benign follow-up questions. Worse, when the classifier flags an inquiry as security-related, it quietly routes the work to Opus. Opus handles the analysis, and you get degraded work compared to what Fable would have delivered.

Anthropic built Mythos as a model tier above Opus and published what that difference looks like in practice: ten times the findings on comparable Firefox releases.

So when Opus finishes auditing your code and reports nothing exploitable, what have you actually learned? Only that there are no bugs an Opus-class model can find. Anthropic’s own numbers prove that is a fraction of what is actually there. You haven’t verified your code is secure; you’ve verified it survived a search one tier below the frontier, and you were never told the search happened at that tier.

That ceiling won’t hold. Every audit that passes at the Opus level is a bet that nothing Mythos or Astra-class will ever be pointed at your attack surface. But frontier engines already exist, and ablated open-weight models in agentic loops are rapidly converging on the exact same workflows, without a classifier deciding which tier is appropriate for them. On a long enough timeline, that bet is guaranteed to lose.

The gatekeeping rests on a misunderstanding of how software security actually works.

Defense is downstream of offense. You cannot verify a fix you cannot attack. A scanner that lists 300 theoretical warnings without the ability to chain an exploit path is useless. It just breeds alert fatigue. Real remediation means proving the vector is reachable, building the proof of concept, shipping the patch, and running the exploit again to confirm the vector is dead.

Neuter the model’s offensive reasoning, and you neuter the audit.

Meanwhile, nobody attacking your systems is applying to Project Glasswing or arguing with commercial API guardrails.

They run local open-weight models: ablated, fine-tuned on exploit repositories, with the guardrails stripped out. Open weights still trail closed frontier models on raw benchmarks, but benchmark scores don’t decide an engagement. An attacker doesn’t need one omniscient model. They just need uncensored weights in an agentic loop with a fuzzing harness behind it, and no safety classifier killing the context window on attempt four hundred.

That leaves three distinct tiers:

Incumbents, who get vetted private access to the frontier tier through closed programs like Glasswing. The 99% of developers, who get models like Fable or Astra that trip alarms, refuse prompts, or quietly hand security work down to lower tiers without telling anyone. Attackers, who get unconstrained offensive intelligence pointed straight at the attack surface, running at machine speed.

Telling developers a cyber tsunami is coming while confiscating their lifeboats is not responsible stewardship. It is security theater. If the labs believe machine-speed cyber warfare is already here, throttling the people trying to inspect their own code is a strange way to act on that belief. Give everyday builders the same offensive firepower and let them tear their own systems apart before someone else does.

Originally posted at: https://eddiemissri.substack.com/p/the-asymmetric-disarmament-of-ai

sys/kern/sysvsem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in syssemget().

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mplsdoerror function within sys/netmpls/mplsinput.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.

sppppapinput in sys/net/ifspppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.

------------------------------------------------------------------------ OpenBSD sppppapinput: PAP Authentication Bypass via Zero-Length bcmp ------------------------------------------------------------------------

Affected:  OpenBSD all versions through 7.6 (fixed in -current) Vendor:    OpenBSD Severity:  High Reporter:  Argus Date:      2026-06-16

1. SUMMARY ==========

The sppppapinput() function in sys/net/ifspppsubr.c uses the attacker-controlled namelen and passwdlen fields from the incoming PAP frame directly as the comparison length for bcmp() against configured credentials.

When both fields are set to zero, bcmp() returns 0 unconditionally (bcmp with length 0 always succeeds). The existing upper-bound guard (> AUTHMAXLEN) allows zero through. As a result, a PAP Auth-Request with namelen=0 and passwdlen=0 passes credential validation and triggers a PAPACK, authenticating the peer without any knowledge of the configured username or password.

A secondary kernel heap over-read exists via the same root cause: supplying a namelen larger than the allocation of the stored credential causes bcmp to read past the heap object.

2. AFFECTED VERSIONS ====================

The bcmp comparison pattern was introduced with the original sppp code import on 1999-07-01 (commit bda3414e, "lmc driver; ported by chris () dqc org"). The zero-length bypass has been exploitable since that date.

In February 2009 (commit 9c2f3d605fc), auth credential fields were changed from fixed-size struct arrays to dynamically allocated malloc(strlen()+1), and the bounds check was changed to AUTHMAXLEN (256). This decoupled the allocation size from the comparison bound, enabling the heap over-read.

Confirmed against OpenBSD 7.6 (amd64) in QEMU/KVM.

3. DETAILS ==========

Vulnerable code (sys/net/ifspppsubr.c, sppppapinput):

if (namelen > AUTHMAXLEN ||       passwdlen > AUTHMAXLEN ||       bcmp(name, sp->hisauth.name, namelen) != 0 ||       bcmp(passwd, sp->hisauth.secret, passwdlen) != 0) {           / authentication failed /

namelen and passwdlen are parsed directly from the PAP frame payload. bcmp(a, b, 0) always returns 0. The > AUTHMAXLEN guard rejects values above 255 but permits zero.

The CHAP handler in the same file already had the correct pattern with an exact-length pre-check:

if (namelen != strlen(sp->hisauth.name)       || bcmp(name, sp->hisauth.name, namelen) != 0) {

The PAP handler never received the same treatment.

4. REACHABILITY ===============

Both bugs are reachable via the PPPoE data path:

pppoedatainput -> pppoeintr -> spppinput -> sppppapinput

Precondition: the target system must be configured as a PAP authenticator (e.g. ifconfig pppoe0 peerproto pap peername <x> peerkey <y>). The attacker does not need to know any credentials.

5. IMPACT =========

An attacker on the same network segment can authenticate to a PPPoE interface without credentials, establishing a full network-layer link (LCP -> PAP -> IPCP -> IP).

When OpenBSD acts as a PPPoE client with mutual authentication, a rogue server in the same broadcast domain can exploit the bypass to impersonate a legitimate server, causing OpenBSD to route traffic through the attacker's endpoint.

6. PROOF OF CONCEPT ===================

A Python PoC acts as a PPPoE server, completes discovery and LCP negotiation, then sends a PAP Auth-Request with namelen=0 and passwdlen=0.

Result:

PAPACK received with empty credentials   VM accepted namelen=0, passwdlen=0 as valid auth.

IPCP Config-Ack received - link is UP   ICMP echo reply from 10.0.0.1

FULL LINK ESTABLISHED

PoC and full technical report:   https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html

7. FIX ======

Fixed in -current by mvs on 2026-06-14. The fix mirrors the CHAP handler's exact-length pre-check:

if (namelen != strlen(sp->hisauth.name) ||       passwdlen != strlen(sp->hisauth.secret) ||       bcmp(name, sp->hisauth.name, namelen) != 0 ||       bcmp(passwd, sp->hisauth.secret, passwdlen) != 0) {

Fix commit: https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8

8. TIMELINE ===========

2026-06-12  Reported to security () openbsd org with PoC   2026-06-14  Fix committed to -current

9. CREDIT =========

Discovered and reported by Argus (https://byteray.co.uk/).

10. REFERENCES ==============

Advisory:   https://pop.argus-systems.ai/advisory/adv-038.html

Blog post: https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html

Proof of concept:   https://pop.argus-systems.ai/attachments/poc-001-pap-bypass.py

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "ndoptlen 8 - 2" expression with no preceding check for whether ndoptlen is zero.

On Fri, Mar 13, 2026 at 01:19:49PM +0000, Stuart Henderson wrote: On 2026/03/13 06:37, Justin Swartz wrote: OpenBSD 7.8 [PARTIAL LEAKAGE] The client blocks most variables which have not been explicitly exported, but potentially sensitive variables such as DISPLAY, XAUTHORITY and PRINTER are leaked without prior export. ha, we've had that for a long time.

--------------------- Date: 2005/02/27 15:46:42 Author: otto Branch: HEAD Tag: OPENBSD37BASE Log: - only send exported vars (based on a diff from Solar Designer) - fix some buffer overflows (also some Solar Designer input)

ok deraadt@ cloder@

Members: authenc.c:1.6->1.7 commands.c:1.47->1.48 externs.h:1.13->1.14 telnet.c:1.18->1.19 --------------------- Oh, I didn't recall.

Looking at this now:

https://cvsweb.openbsd.org/src/usr.bin/telnet

I see that these exports are explicit in commands.c:

envexport("DISPLAY"); envexport("PRINTER"); envexport("XAUTHORITY");

Also, there's support for the TERMINAL-TYPE (RFC 1091) and X-DISPLAY-LOCATION (RFC 1096) telnet protocol options in telnet.c, which would send TERM and DISPLAY even if these are not exported.

Looking at RHEL 9 telnet-0.17-85.el9's telnet-0.17-env.patch against Linux NetKit, I see it also deliberately allows TERM and DISPLAY to be sent via these protocol options even if not exported.

Perhaps these default exports once made sense, but not anymore... except maybe for TERM, which still needs to work out of the box?

I also found there's OpenBSD-derived telnet-bsd package in Gentoo (client and server) and OpenWrt (client only), originally ported by Thorsten Kukuk of SUSE. I didn't check when it was forked, nor whether it already contains the 2005 fixes mentioned above or equivalent. Someone (perhaps involved with those distros) could want to check.

Alexander

On 2026/03/13 06:37, Justin Swartz wrote: OpenBSD 7.8 [PARTIAL LEAKAGE] The client blocks most variables which have not been explicitly exported, but potentially sensitive variables such as DISPLAY, XAUTHORITY and PRINTER are leaked without prior export. ha, we've had that for a long time.

--------------------- Date: 2005/02/27 15:46:42 Author: otto Branch: HEAD Tag: OPENBSD37BASE Log: - only send exported vars (based on a diff from Solar Designer) - fix some buffer overflows (also some Solar Designer input)

ok deraadt@ cloder@

Members: authenc.c:1.6->1.7 commands.c:1.47->1.48 externs.h:1.13->1.14 telnet.c:1.18->1.19 ---------------------

openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a length of zero for block data, because the relationship between p->rem and p->len is not checked.

In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.

A double free or use after free could occur after SSLclear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.

lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded with 0.

httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header.

The systhrsigdivert function in kern/kernsig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of service (panic) via a negative "ts.tvsec" value.

The (1) remoteglob function in sftp-glob.c and the (2) processput function in sftp.c in OpenSSH 5.8 and earlier, as used in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, OpenBSD 4.7, and other products, allow remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in SSHFXPSTAT requests to an sftp daemon, a different vulnerability than CVE-2010-2632.

The glob implementation in libc in FreeBSD 7.3 and 8.1, NetBSD 5.0.2, and OpenBSD 4.7, and Libsystem in Apple Mac OS X before 10.6.8, allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.

The pftestrule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload.

Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number.

Integer overflow in the ftsbuild function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the ftslevel structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.

The aspathprepend function in rdeattr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autonomous System (AS) advertisement containing a long AS path.

Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.

Stack-based buffer overflow in the consoptions function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.

Multiple race conditions in the (1) Sudo monitor mode and (2) Sysjail policies in Systrace on NetBSD and OpenBSD allow local users to defeat system call interposition, and consequently bypass access control policy and auditing.

The IPv6 protocol allows remote attackers to cause a denial of service via crafted IPv6 type 0 route headers (IPV6RTHDRTYPE0) that create network amplification between two routers.

Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.

Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.

Buffer overflow in kern/uipcmbuf2.c in OpenBSD 3.9 and 4.0 allows remote attackers to execute arbitrary code via fragmented IPv6 packets due to "incorrect mbuf handling for ICMP6 packets." NOTE: this was originally reported as a denial of service.

OpenBSD before 20070116 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via certain IPv6 ICMP (aka ICMP6) echo request packets.

Unspecified vulnerability in sys/dev/pci/vgapci.c in the VGA graphics driver for wscons in OpenBSD 3.9 and 4.0, when the kernel is compiled with the PCIAGP option and a non-AGP device is being used, allows local users to gain privileges via unspecified vectors, possibly related to agpioctl NULL pointer reference.