AI Cybersecurity After Mythos: The Jagged Frontier

AI Cybersecurity After Mythos: The Jagged Frontier

Author: Stanislav Fort

Why the moat is the system, not the model

TL;DR: We tested Anthropic Mythos's showcase vulnerabilities on small, cheap, open-weights models. They recovered much of the same analysis. AI cybersecurity capability is very jagged: it doesn't scale smoothly with model size, and the moat is the system into which deep security expertise is built, not the model itself. Mythos validates the approach but it does not settle it yet.

The announcement

On April 7, Anthropic announced Claude Mythos Preview and Project Glasswing, a consortium of technology companies formed to use their new, limited-access AI model called Mythos, to find and patch security vulnerabilities in critical software. Anthropic committed up to 100M USD in usage credits and 4M USD in direct donations to open source security organizations.

The accompanying technical blog post from Anthropic's red team refers to Mythos autonomously finding thousands of zero-day vulnerabilities across every major operating system and web browser, with details including a 27-year-old bug in OpenBSD and a 16-year-old bug in FFmpeg. Beyond discovery, the post detailed exploit construction of high sophistication: multi-vulnerability privilege escalation chains in the Linux kernel, JIT heap sprays escaping browser sandboxes, and a remote code execution exploit against FreeBSD that Mythos wrote autonomously.

This is important work and the mission is one we share. We've spent the past year building and operating an AI system that discovers, validates, and patches zero-day vulnerabilities in critical open source software. The kind of results Anthropic describes are real.

But here is what we found when we tested: We took the specific vulnerabilities Anthropic showcases in their announcement, isolated the relevant code, and ran them through small, cheap, open-weights models. Those models recovered much of the same analysis. Eight out of eight models detected Mythos's flagship FreeBSD exploit, including one with only 3.6 billion active parameters costing $0.11 per million tokens. A 5.1B-active open model recovered the core chain of the 27-year-old OpenBSD bug.

And on a basic security reasoning task, small open models outperformed most frontier models from every major lab. The capability rankings reshuffled completely across tasks. There is no stable best model across cybersecurity tasks. The capability frontier is jagged.

This points to a more nuanced picture than "one model changed everything."

Context: where AI cybersecurity already stands

At AISLE, we've been running a discovery and remediation system against live targets since mid-2025: 15 CVEs in OpenSSL (including 12 out of 12 in a single security release, with bugs dating back 25+ years and a CVSS 9.8 Critical), 5 CVEs in curl, over 180 externally validated CVEs across 30+ projects spanning deep infrastructure, cryptography, middleware, and the application layer. Our security analyzer now runs on OpenSSL, curl and OpenClaw pull requests, catching vulnerabilities before they ship.

We used a range of models throughout this work. Anthropic's were among them, but they did not consistently outperform alternatives on the cybersecurity tasks most relevant to our pipeline. The strongest performer varies widely by task, which is precisely the point. We are model-agnostic by design.

The metric that matters to us is maintainer acceptance. When the OpenSSL CTO says "We appreciate the high quality of the reports and their constructive collaboration throughout the remediation," that's the signal: closing the full loop from discovery through accepted patch in a way that earns trust.

Decomposing the pipeline

The Mythos announcement presents AI cybersecurity as a single, integrated capability. In practice, however, AI cybersecurity is a modular pipeline of very different tasks, each with vastly different scaling properties:

• Broad-spectrum scanning: navigating a large codebase to identify which functions are worth examining.
• Vulnerability detection: given the right code, spotting what's wrong.
• Triage and verification: distinguishing true positives from false positives.
• Patch generation: fixing the vulnerability correctly.
• Exploit construction: turning a vulnerability into a working attack.

Our practical experience suggests that the reality is very uneven. We view the production function for AI cybersecurity as having multiple inputs: intelligence per token, tokens per dollar, tokens per second, and the security expertise embedded in the scaffold and organization that orchestrates all of it. Anthropic is undoubtedly maximizing the first input with Mythos. AISLE's experience suggests the others matter just as much.

The bottom line: the moat is the system

Anthropic's own scaffold is described in their technical post: launch a container, prompt the model to scan files, let it hypothesize and test, use ASan as a crash oracle. That is very close to the kind of system we and others in the field have built. The value lies in the targeting, the iterative deepening, the validation, the triage, the maintainer trust. The public evidence so far does not suggest that these workflows must be coupled to one specific frontier model.

There is a practical consequence of jaggedness. Because small, cheap, fast models are sufficient for much of the detection work, you don't need to judiciously deploy one expensive model. You can deploy cheap models broadly, scanning everything. A thousand adequate detectives searching everywhere will find more bugs than one brilliant detective who has to guess where to look. This changes the economics of the entire defensive pipeline.