Claude Mythos scans open source, flags 77 critical issues

Overview

8 stories in this issue. The first 3 are today's priorities.

Hot Model Updates

1. Top · Claude Mythos powers a free open-source vulnerability scanner, flagging 77 critical findings in 11 days
2. Top · Grok releases the first seven minutes of its AI-generated "Odyssey"
3. Top · KRAFTON previews Raon-1 mini: a 30B-A4B open model under Apache 2.0

Global AI News

4. OpenAI's £100M for the UK AI Biosecurity Lab is spread over five years
5. An AGENTS.md file in a Downloads folder steered a coding agent toward a malicious npm package
6. r/opensource bans AI-related projects and faces a community backlash

Regional & Early Signals

7. CrowdGPT wants to train a 1B-parameter model on idle gaming GPUs
8. Linux Foundation survey: AI cuts coding time 52%, but maintainers estimate a quarter of PRs are "AI slop"

Jiufeng graphic based on the sources cited in this issue.

Hot Model Updates

Anthropic's OSS Scanner runs Claude Mythos and other models on critical open-source projects and sends reports straight to maintainers, with no human review.

OSS Scanner is free and opt-in. It is run jointly by Anthropic's Frontier Red Team and Safeguards Research team and launched on October 8. Maintainers supply a Dockerfile, and audits run on Anthropic's infrastructure inside an isolated VM with no Internet access. Figures as of October 19:

According to MarkTechPost, wolfSSL says 72 of the 74 reports it received were valid. The report also cites a curl issue that affected versions 8.12.0 through 8.22.0 and was fixed in 8.23.0, released October 14.

Limitations: The 77 and 803 figures are severity ratings assigned by the model, not confirmed vulnerabilities. Reports go out without human review, and 11 of the 97 audited findings duplicated known issues, so triage work falls on maintainers.

Image source: Frontier Red Team Research; mirrored on Jiufeng R2.

Source: Anthropic OSS Scanner · Anthropic announcement · ClaudeDevs · MarkTechPost

Three months after Musk said Grok would release a full-length, "historically accurate" movie of "The Odyssey," Grok has published seven minutes and calls it the first episode of a series.

According to IT Home, Musk had publicly criticized Christopher Nolan's "The Odyssey" for casting non-white and transgender actors. Three months later, Grok released the first seven minutes of its own version as episode one of its Odyssey series.

Limitations: TechCrunch's verdict is that the footage looks okay as long as you are not looking for artistry, inspiration or human interest. Seven minutes is all that has shipped so far, far short of the full-length film Musk promised.

Source: TechCrunch · Elon Musk's original announcement · IT Home (Chinese-language source)

KRAFTON AI, the AI arm of Korean game company KRAFTON, trained Raon-1 mini from scratch with a focus on Korean plus English, and has posted preview weights on Hugging Face.

• Architecture: Mixture of Experts with 30B total and 4B active parameters, linear attention and speculative decoding
• Languages: Korean-first with fluent English; aimed at instruction following and multi-step agent tasks
• License: Apache 2.0
• Evaluation: the Hugging Face model card lists results on 18 benchmarks
• Access: free API for a limited time (sign-up required), plus a no-login web demo

Limitations: This is a preview. KRAFTON says the full release and larger models are "coming" but has not given dates. The claim that it performs close to much larger models while using less compute comes from KRAFTON and has not been independently evaluated.

Source: KRAFTON Raon-1 mini · Hugging Face

Global AI News

An OpenAI spokesperson told RuntimeWire the commitment is compute and model credits spread over five years, not cash.

The lab's headline backing is £300 million, and two-thirds of that is credits from OpenAI and Anthropic rather than cash. OpenAI's share also includes trusted access to its most capable relevant models through its Rosalind Biodefense programme.

Limitations: The UK government announced the commitment without giving its duration or terms. The five-year figure comes from one OpenAI spokesperson speaking to a single outlet, and how much compute it buys each year is still unclear.

Source: RuntimeWire

Forever Security says it stopped an AI coding agent from installing a malicious npm package after tracing the instruction to an AGENTS.md file in a customer's Downloads folder.

The report, published October 22 by researchers Gal Weizman and Omer Samet, documents how an ordinary downloaded text file became commands run by an agent with access to the customer's machine. The researchers then reproduced the techniques against Codex and Claude Code, which responded differently and had different limits.

Limitations: Forever could not establish how the original file reached the customer's machine. The test attacks were reproductions and do not show that either tool is exploitable in its default configuration.

Source: RuntimeWire

The r/opensource subreddit's new submission rules exclude any project that uses AI, is made by AI or is intended for AI.

The rules were posted Saturday evening and open with: "If your project uses AI, is made by AI, or is intended for AI, it's not welcome on r/opensource." According to The Verge, the rules also restrict non-English speakers, among other changes. Moderator Wolvereness said in the comments that enforcement would be selective, with exceptions such as software that has AI-based accessibility features like automatic captioning.

Limitations: Many users call the rules too broad or vague, and a rival subreddit, r/trueopensource, has been created. How the rules are applied is still up to the moderators.

Source: The Verge

Regional & Early Signals

A developer project aims to train a 1-billion-parameter open model without datacenters by pooling consumer RTX cards.

The client is a single, human-readable Python file. It streams 10MB chunks of the public CrowdGPT dataset from Hugging Face, trains locally and uploads only the model update. The project says the client never accesses local files or browser history.

• Progress: the Hugging Face model card says 6B tokens trained so far, status "training in progress"; the site shows live training metrics and a contributor leaderboard
• Update checks: each update is checked for size, NaN values and a norm cap, then cross-validated by other nodes; repeat offenders are banned
• Access: weights are free on Hugging Face and the source is on GitHub

Limitations: This is an early project found through a community post, and everything here is the project's own description. The model is still training and has no independent evaluation yet.

Source: CrowdGPT · GitHub · Hugging Face

LF Research's survey finds generative AI speeds up writing code while adding to maintainers' load of low-quality contributions.

The report, "Navigating Open Source Software Development in the Generative AI Era," was released October 20 and sponsored by Red Hat.

Limitations: All shares are respondents' own estimates, not measurements of repositories. The coverage cited here is a Chinese-language report.

Source: InfoQ China (Chinese-language source)