Mythos Marks an Acceleration in AI-Driven Vulnerability Discovery, Not a Beginning
Summary
The author argues that Mythos accelerates an existing trend in AI-assisted vulnerability discovery, citing vendor and open-source examples, while warning that organizations may struggle to triage and remediate the growing volume of findings.
Key points
- Anthropic’s Claude Mythos Preview reportedly found vulnerabilities across major operating systems and browsers; Firefox 150 included fixes for 271 vulnerabilities identified during an early evaluation.
- Anthropic launched Project Glasswing, a coalition using Mythos to find and fix vulnerabilities in critical infrastructure, rather than releasing the model publicly.
- The author argues that AI cybersecurity capabilities build on earlier model knowledge and deliberate improvements in coding and reasoning, rather than emerging unexpectedly.
- Open-source maintainers cited a sharp rise in security reports, with many reports now considered accurate and actionable.
- The author’s AIVulnBench tests AI coding agents on real vulnerability datasets; the article says GPT-5.4-nano helped identify previously unfixed FreeBSD kernel bugs, including two confirmed issues in NFS RPCsec_gss.
- The article argues that increased vulnerability discovery can overwhelm teams unless they can prioritize, manage, and remediate findings effectively.
Article Details
- Topic
- AI models and coding agents accelerating cybersecurity vulnerability discovery, with an emphasis on remediation challenges and the view that Claude Mythos continues an existing trend rather than initiating a new one.
CVE
People
Daniel StenbergcURL lead developer quoted on the volume and quality of AI-generated security reports.Greg Kroah-HartmanLinux kernel maintainer quoted on the increase in AI-generated security reports.Kyle DaigleIdentified as GitHub's COO and quoted on GitHub platform activity.Laurent HausermannAuthor of the article and creator of the AIVulnBench benchmark.Rick MacklemFreeBSD NFS maintainer who confirmed one reported bug and was committing its fix.Simon WillisonRecommended by the author for curating signals from the open-source world.William GibsonQuoted for the article's opening and closing observation about the future.Willy TarreauHAProxy lead developer quoted on the increase in kernel security reports.
Vendors
AnthropicAnthropic made headlines last week. I paused before writing because I wasn’t sure what to make of it. Was this marketing? Where’s the evidence this is a real breakthrough?MozillaThe Mozilla Firefox team released Firefox 150 this week and praised a world without vulnerabilities:OpenAIFor the moment, only OpenAI Codex is implemented (and was used to implement the benchmark), but I’d like to see the same for Gemini CLI or Mistral Vibe.
Products
AIVulnBenchOver the past weeks, I’ve been running AIVulnBench, a small reproducible benchmark I built to test whether AI coding agents can identify real vulnerabilities in open-source code given the relevant source files.Claude 4.5Claude 4.5 and the Maturity Moment for Cybersecurity AIClaude Mythos PreviewClaude Mythos Preview, announced on April 7, 2026, is a general-purpose model that demonstrated something the security community needs to take seriously:curlDaniel Stenberg, the lead developer of cURL, is living the same reality:CyBenchthe first time that framing appeared in a release announcement. They were already evaluating against CyBench.CyberGymOn the CyberGym benchmark, it scored 83.1% vs.Firefox 150The Mozilla Firefox team released Firefox 150 this week and praised a world without vulnerabilities:FreeBSDWe reported several bugs to FreeBSD through both the public kernel mailing list and responsible disclosure to the security team. Some have already been confirmed by maintainers, others are under active investigation.Gemini CLIFor the moment, only OpenAI Codex is implemented (and was used to implement the benchmark), but I’d like to see the same for Gemini CLI or Mistral Vibe.GPT-4GPT-4's Remarkable Performance in CEH ExamGPT-5.4The OpenAI Codex, using the standard GPT-5.4 model, not their “cyber” flavors, results are pretty interesting:GPT-5.4-nanodoes. Second, they developed a simple scanner and an AI harness, and, to prove their point, used GPT-5.4-nano, an entry-level model similar to OSS models.HAProxyAnd Willy Tarreau, lead developer of HAProxy, adds the numbers:Mistral VibeFor the moment, only OpenAI Codex is implemented (and was used to implement the benchmark), but I’d like to see the same for Gemini CLI or Mistral Vibe.Mozilla FirefoxIn Firefox exploit development, Mythos produced 181 working exploits, compared to Opus 4.6’s 2 out of several hundred attempts.OpenAI CodexFor the moment, only OpenAI Codex is implemented (and was used to implement the benchmark), but I’d like to see the same for Gemini CLI or Mistral Vibe.Opus 4.6Opus 4.6’s 66.6%