In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may cause the system to incorrectly reset a session. This is fixed in OpenBSD 7.3 errata 006.
In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "ndoptlen 8 - 2" expression with no preceding check for whether ndoptlen is zero.
IP fragment assembly in OpenBSD 2.4 allows a remote attacker to cause a denial of service by sending a large number of fragmented packets.
cron in OpenBSD 2.5 allows local users to gain root privileges via an argv[] that is not NULL terminated, which is passed to cron's fake popen function.
Vulnerability in OpenBSD 2.6 allows a local user to change interface media configurations.
In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.
An issue was discovered in the kernel in OpenBSD 6.6. The WEP, WPA, WPA2, and WPA3 implementations treat fragmented frames as full frames. An adversary can abuse this to inject arbitrary network packets, independent of the network configuration.
A vulnerability was discovered in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android that allows a malicious access point, or an adjacent user, to determine if a connected user is using a VPN, make positive inferences about the websites they are visiting, and determine the correct sequence and acknowledgement numbers in use, allowing the bad actor to inject data into the TCP stream. This provides everything that is needed for an attacker to hijack active connections inside the VPN tunnel.
OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211michaelmicfailure() function within sys/net80211/ieee80211cryptotkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.
ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser.
openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a length of zero for block data, because the relationship between p->rem and p->len is not checked.
Format string vulnerability in OpenBSD fstat program (and possibly other BSD-based operating systems) allows local users to gain root privileges via the PWD environmental variable.
Format string vulnerability in pwerror function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd.
Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges.
Format string vulnerability in OpenBSD yppasswd program (and possibly other BSD-based operating systems) allows attackers to gain root privileges a malformed name.
Format string vulnerability in OpenBSD su program (and possibly other BSD-based operating systems) allows local attackers to gain root privileges via a malformed shell.
OpenBSD 2.6 and earlier allows remote attackers to cause a denial of service by flooding the server with ARP requests.
The AI industry is running a contradiction it hasn’t resolved.
Frontier labs are warning about an imminent software security collapse. Anthropic reported that Claude Mythos found zero-days in codebases hardened by decades of review: a 27-year-old denial-of-service bug in OpenBSD’s TCP SACK implementation, and a 17-year-old remote code execution flaw in FreeBSD’s NFS server that hands an unauthenticated user root (CVE-2026-4747). Mozilla, testing Mythos Preview against Firefox 150, surfaced 271 vulnerabilities, more than ten times what it found in Firefox 148 using Claude Opus 4.6. OpenAI is sounding the exact same alarm, touting GPT-6 Astra saturating ExploitBench while warning that autonomous attack capabilities are scaling faster than human defenders can patch.
To be fair, Anthropic acted on part of this. Project Glasswing puts $100M in credits behind partnerships with Microsoft, Apple, CrowdStrike, and the Linux Foundation.
Glasswing makes sense for foundational open-source packages and mega-cap infrastructure. It does nothing for the other 99% of software developers. The startups, the internal tool builders, and the mid-market engineering teams writing the proprietary software that runs the rest of the world don’t have an organizational sponsor. Yet they are expected to hold off machine-speed exploits without access to the intelligence that found them.
What they get instead are models like Claude Fable or public endpoints of Astra, sitting behind hair-trigger safety classifiers and preemptive capability caps.
Labs are terrified of prompt injection and “I’m an authorized pen tester” jailbreaks, so the filters cast an absurdly wide net. Paste in complex code and ask the model to trace an execution path, analyze memory corruption, or check whether untrusted input can reach a sensitive sink, and the classifier fires immediately.
Security researchers have already documented Claude Code blocking vulnerability work outright, throwing errors about “violative cyber content” that contaminate the entire session and spread to benign follow-up questions. Worse, when the classifier flags an inquiry as security-related, it quietly routes the work to Opus. Opus handles the analysis, and you get degraded work compared to what Fable would have delivered.
Anthropic built Mythos as a model tier above Opus and published what that difference looks like in practice: ten times the findings on comparable Firefox releases.
So when Opus finishes auditing your code and reports nothing exploitable, what have you actually learned? Only that there are no bugs an Opus-class model can find. Anthropic’s own numbers prove that is a fraction of what is actually there. You haven’t verified your code is secure; you’ve verified it survived a search one tier below the frontier, and you were never told the search happened at that tier.
That ceiling won’t hold. Every audit that passes at the Opus level is a bet that nothing Mythos or Astra-class will ever be pointed at your attack surface. But frontier engines already exist, and ablated open-weight models in agentic loops are rapidly converging on the exact same workflows, without a classifier deciding which tier is appropriate for them. On a long enough timeline, that bet is guaranteed to lose.
The gatekeeping rests on a misunderstanding of how software security actually works.
Defense is downstream of offense. You cannot verify a fix you cannot attack. A scanner that lists 300 theoretical warnings without the ability to chain an exploit path is useless. It just breeds alert fatigue. Real remediation means proving the vector is reachable, building the proof of concept, shipping the patch, and running the exploit again to confirm the vector is dead.
Neuter the model’s offensive reasoning, and you neuter the audit.
Meanwhile, nobody attacking your systems is applying to Project Glasswing or arguing with commercial API guardrails.
They run local open-weight models: ablated, fine-tuned on exploit repositories, with the guardrails stripped out. Open weights still trail closed frontier models on raw benchmarks, but benchmark scores don’t decide an engagement. An attacker doesn’t need one omniscient model. They just need uncensored weights in an agentic loop with a fuzzing harness behind it, and no safety classifier killing the context window on attempt four hundred.
That leaves three distinct tiers:
Incumbents, who get vetted private access to the frontier tier through closed programs like Glasswing. The 99% of developers, who get models like Fable or Astra that trip alarms, refuse prompts, or quietly hand security work down to lower tiers without telling anyone. Attackers, who get unconstrained offensive intelligence pointed straight at the attack surface, running at machine speed.
Telling developers a cyber tsunami is coming while confiscating their lifeboats is not responsible stewardship. It is security theater. If the labs believe machine-speed cyber warfare is already here, throttling the people trying to inspect their own code is a strange way to act on that belief. Give everyday builders the same offensive firepower and let them tear their own systems apart before someone else does.
Originally posted at: https://eddiemissri.substack.com/p/the-asymmetric-disarmament-of-ai
OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mplsdoerror function within sys/netmpls/mplsinput.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
sppppapinput in sys/net/ifspppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.
sys/kern/sysvsem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in syssemget().
A double free or use after free could occur after SSLclear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3. NOTE: OpenSSL is not affected.
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for a large file using an HTTP Range header.
The aspathprepend function in rdeattr.c in bgpd in OpenBSD 4.3 and 4.4 allows remote attackers to cause a denial of service (application crash) via an Autonomous System (AS) advertisement containing a long AS path.
Integer overflow in the ftsbuild function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the ftslevel structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.
chpass in OpenBSD 2.0 through 3.2 allows local users to read portions of arbitrary files via a hard link attack on a temporary file used to store user database information.
OpenBSD kernel 3.3 and 3.4 allows local users to cause a denial of service (kernel panic) and possibly execute arbitrary code in 3.4 via a program with an invalid header that is not properly handled by (1) ibcs2exec.c in the iBCS2 emulation (compatibcs2) or (2) execelf.c, which leads to a stack-based buffer overflow.
The arplookup function in FreeBSD 5.1 and earlier, Mac OS X before 10.2.8, and possibly other BSD-based systems, allows remote attackers on a local subnet to cause a denial of service (resource starvation and panic) via a flood of spoofed ARP requests.
The DNS map code in Sendmail 8.12.8 and earlier, when using the "enhdnsbl" feature, does not properly initialize certain data structures, which allows remote attackers to cause a denial of service (process crash) via an invalid DNS response that causes Sendmail to free incorrect data.
A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences.