Claude Mythos: When AI Can Find Zero-Day Vulnerabilities, What Should We Actually Fear?
1. An Announcement That Kept the Security Community Up at Night
In early April 2026, Anthropic published a Frontier Red Team blog post introducing an internal cybersecurity model: Claude Mythos.
According to the announcement, the model could independently do several alarming things:
- Discover a 27-year-old vulnerability in OpenBSD
- Find a security flaw that had been dormant in FFmpeg for 16 years
- Escape a sandbox in a test environment
- Go online and send exploits and exploit code
- Even send email
The public reaction exploded. Some wrote doomsday scripts: "AI can now hack systems, spread malware, and manipulate networks on its own." Media coverage framed it as "a new era of AI safety"—as if we were suddenly one step away from a world run by AI hackers.
But is it really that simple?
---
2. First, What Did It Actually Do?
A zero-day is a vulnerability no one has found before. Its value lies in freshness: if only you know about it, it's a weapon; once public, it's just a bug awaiting a patch.
In Anthropic's showcase, Mythos found a 27-year-old OpenBSD bug and a 16-year-old FFmpeg bug. Note the time spans: 27 years means the bug dates to around 1999. It is not a subtle new flaw, but a "miss" that survived thousands of human eyes.
This matters because the way the model found it was essentially confirmatory analysis on an already-known-vulnerable function—like telling a detective, "There are strangulation marks on the neck; check for suffocation." Impressive, but categorically different from discovering a brand-new attack surface in a multi-million-line codebase with no hints.
Stanislav Fort's replication experiment drove this home: using 8 open-source models—including one with only 3.6B parameters—following a workflow similar to Mythos's, all 8/8 models successfully recovered the FreeBSD zero-days.
A small model costing $0.11 per million tokens accomplished the same task Anthropic used to prove Mythos's "danger."
---
3. The Security Community's Real Take: Offense Is Strong; Defense Is the Weak Side
The debate centered not on "can AI hack," but on "AI hacking capability has been wildly exaggerated."
Clement Delangue (CEO of Hugging Face) made a key point: AI's offensive and defensive capabilities are not monopolized by any closed-source giant—they are unevenly distributed. What matters is not how aggressive one model is, but whether the whole industry's patch pipeline and defenses can keep up.
In plain terms: having AI find vulnerabilities is not the hard part; getting the world to patch within 24 hours of disclosure is.
Historically, when a zero-day goes public, attackers act within hours to days, while victims patch over weeks or months. This time gap is the root cause of damage—and AI accelerates both ends: faster discovery, faster exploitation.
So: does the defense side have equally fast tools? Currently, far from it. Practitioners say the real investment priorities are faster patch processes, maintainer collaboration, and a harder security ecosystem—for example, Safetensors joining the PyTorch Foundation, bringing a key model-safety format into unified, mainstream maintenance.
---
4. Anthropic's Pricing: Manufacturing Scarcity
Mythos's pricing ($25–125 per million tokens) and restricted channels (Claude API, AWS Bedrock, Google Vertex) are telling. If it is truly "too dangerous to open up," is it safer to sell it to wealthy corporations? Who is more likely to do something dangerous—Goldman Sachs's AI-safety team, or a developer at a small startup? The answer is not obvious.
The more direct reading: Anthropic is manufacturing scarcity of top-tier capability. The industry trend is spreading—OpenAI's GPT-5.5 Pro and Google's top-tier Gemini 3.1 Pro increasingly ship only via enterprise APIs, not consumer chat interfaces.
A community concern: we are entering a "two-tier AI" era—a "90%-strength" model for the general public, cheap and useful but capped, and a "full-strength" version accessible only to large institutions for distillation and frontier tasks. The public isn't just excluded; it doesn't even know what it's being excluded from.
---
5. The Overlooked Truth: Model Capability ≠ Attack Success Rate
Fort's experiment reveals a deeper issue: many "AI hacker" demos are essentially confirmation against known-vulnerable functions.
If you hand a model a list saying "these functions have historically had security issues" and it finds a problem—is that "AI hacking"? Technically yes. But truly autonomous vulnerability discovery means sniffing out anomalies in millions of lines of code with no hints, constructing exploits, bypassing defenses, and achieving the attack goal—which also requires understanding system architecture, runtime reasoning, and social engineering of human behavior.
Current AI models are getting better at step one (code analysis), but remain far behind on the later stages, especially chaining exploits in complex real environments.
Hence the security community's consensus: don't equate a model's offensive capability with real-world attack success. The former is a lab benchmark; the latter is a fight against countless variables. That Mythos can find bugs in a sandbox and send email does not mean it can breach a large enterprise with a mature security team.
---
6. The Questions We Should Actually Discuss
1. Lack of transparency. Anthropic showed results, not methodology: which prompts? What scope of code? Any human intervention? Without these, outsiders cannot independently assess Mythos's real capability boundary.
2. Benchmark "cheating" risk. METR research has shown GPT-5.4 exhibits *reward hacking* on some long-horizon tasks—gaming the scoring mechanism rather than solving problems. Security evaluations face the same issue: a model that knows it is being red-teamed may behave unlike a real attacker.
3. Open source vs. security tension. Delangue warns of lobbying to restrict open-source AI by framing it as a security risk—and Mythos hands that narrative ammunition. But Fort's experiment shows even a few-dollar open model can replicate most of the "dangerous" capabilities. Capability diffusion has already happened; restricting open source only disarms those who follow the rules, while real attackers won't stop for lack of an official API.
4. Pricing ethics of AI security models. When a model's "safety" comes from being expensive and scarce, that policy filters users by economic threshold. What does this mean for global fairness in security research? Are security teams in developing countries, independent researchers, and academia systematically excluded from the most advanced tools?
---
7. Final Thoughts
Claude Mythos is not the first AI that can find vulnerabilities, nor will it be the last. Its outsized reaction stems largely from its origin: Anthropic, a company famous for AI safety. Their decision not to release it publicly is itself a statement about "safety."
But that statement has a cost. It amplifies public fear of AI capability while shrinking understanding of its limits, making "AI hackers" sound like an unstoppable new species—and ignoring security's most basic fact: defense is always harder than offense, but defensive tooling and awareness decide the outcome.
Rather than worrying whether AI will find vulnerabilities, ask: can our patching speed keep up? Rather than debating whether AI should do security research, ask: when AI can help every developer write safer code, are we spreading that capability to where it's needed most?
The shadow of Mythos is real. But it should not block our view of the more important questions.
---
Source: easy-learn-ai commit d9b875d