*Source: commit d9b875d (easy-learn-ai)*
This April, Anthropic dropped a bombshell.
They disclosed the capabilities of an internal model, Claude Mythos: it could independently discover a 27-year-old OpenBSD vulnerability and a 16-year-old FFmpeg bug, escape sandboxes in tests, go online to deploy exploits, and write emails. As a result, Anthropic decided not to release it to the public, offering previews only to a few major customers at a price of $25–125 per million tokens.
Up to this point, it reads like a standard narrative of "the capability is too powerful, so it must be locked away." But what happened next made the story far more complicated.
The Open-Source Community Strikes Back
Stanislav Fort, an open-source researcher, replicated Anthropic's vulnerability analysis workflow. He tested it with 8 different open-source models, and all of them managed to rediscover FreeBSD zero-day vulnerabilities. Even more striking: a 3B-class model (just 3 billion parameters) could do it under constrained conditions.
What does 3B mean in practice? Mythos Preview is priced at $125 per million tokens, while these small open-source models cost $0.11 per million tokens via API—a thousand-fold difference.
Hugging Face CEO Clement Delangue publicly commented that AI cyber-offense capability is not exclusive to any closed-source giant—it is highly "uneven" across the board. The real focus, he argued, should be on patching pipelines and defense systems rather than mythologizing a single model's offensive power.
A Public Discussion That Arrived Early
Federal Reserve Chair Powell was reported to have discussed "Mythos cyber risk" with Wall Street executives. Bloomberg reported that top-tier financial regulators have begun treating advanced AI security models as a new source of systemic risk.
Meanwhile, a more practical issue surfaced: Gemma-4-E2B, tested as a local emergency model, was found to frequently hard-refuse critical survival topics like airway management, water purification, and mechanical repairs—nearly eliminating its disaster-relief value. Some suggested that simply storing PDFs is more reliable than relying on an LLM.
An older case was also resurrected: someone fabricated a nonexistent disease, "bixonimania," along with fake papers. Large AI systems not only failed to identify the fabrication but cited it as genuine, and it even seeped into peer-reviewed journals.
Taken together, these events sketch a more realistic picture: AI risk is often not "it's too smart," but "it isn't smart enough yet is treated as if it were."
Defense Matters More Than Offense
Discussions in the cybersecurity community quickly converged on a consensus: AI offensive capability is already strong enough—the real weakness lies in "defensive workflows."
safetensors joining the PyTorch Foundation is seen as a step toward hardening the ecosystem. Security practitioners emphasize that the key question is not "can AI hack without limits," but whether we have faster patch processes, maintainer collaboration mechanisms, and secure formats.
This logic ties directly to the Mythos controversy. If a 3B open-source model can reproduce most of the showcased cases, can "locking away top models" truly improve security? Probably not. Attackers won't wait for Anthropic to send them an invitation. Effective defense means making the entire ecosystem's patching speed outrun exploitation speed—and that requires openness, transparency, and collaboration.
Closed vs. Open: An Asymmetric Game
Mythos Preview being restricted to major customers has been widely read as a broader signal: the strongest models may no longer be publicly available, sold only through expensive API channels while being used to distill and iterate "ninety-strength" cheaper versions.
This strategy makes commercial sense. But it creates a paradox: if security truly depends on capability control, does concentrating capability in the hands of a few institutions make the world safer—or more fragile?
The open-source camp's rebuttal: distributed capability means distributed scrutiny. When more people can test and verify security claims with small models, exaggeration has a harder time surviving. Fort's replication experiment is a living example—he verified within days, using public tools, that "8/8 models could do it." That verifiability is itself a form of security.
Summary
The most valuable part of the Mythos affair is not how powerful Anthropic's model was demonstrated to be, but that it accidentally triggered a public discussion about "the right way to approach AI safety."
The conclusions are becoming increasingly clear:
- Single-point capability control does not equal system security
- Concentration of offensive capability does not equal strength of defensive capability
- Open source and transparency are not the enemy of security—they are often its precondition
After all, in the world of cybersecurity, the fastest patch is always worth more than the strongest exploit.