Without waiting for an unreleased frontier model, AI systems already in wide use can autonomously discover and exploit vulnerabilities given the right execution setup — a view gaining ground across the cybersecurity field.
April 7, 2026 · Anthropic
Claude Mythos Preview finds zero-days on its own — but the frontier may already be here
Anthropic's partner-limited cyber model autonomously discovers vulnerabilities and writes working exploits. Yet evaluators argue that the agentic workflow — not the frontier model — is what unlocks the capability, with small, cheap models already reproducing the showcase bugs.
1000s
zero-days found across major OSes & all major browsers
83%+
exploit generation success on first attempt
27 yrs
age of an OpenBSD flaw it surfaced
Firefox internal test · working exploits generated
Same conditions, same target — Mythos vs. the prior frontier model.
A roughly 90× jump — evaluators call it a qualitative leap, not an increment.
The "jagged frontier" counter-argument
Small, cheap models already reproduced the bugs Mythos showcased — suggesting the agentic workflow matters more than the model.
3.6B
active-param model detected the FreeBSD buffer overflow — at $0.11 per million tokens
5.1B
model fully reproduced the OpenBSD SACK exploit chain
Offense is already real — the numbers
90%
of tactical steps automated by a state-backed group across ~30 targets
⅓→50%+
AI-assisted share of high-risk cyber incidents, in one year
29 min
average adversary breakout time
Vulnerabilities became the leading intrusion vector for the first time, overtaking stolen credentials.
Defender upside
The same model, turned proactively on your own code, fixes long-neglected bugs — the stated intent of Project Glasswing. Third parties (AISI, Cloudflare, Palo Alto) confirmed autonomous multi-stage capability.
Open concerns
Restricting public versions could tie defenders' hands. Plus false positives in small models, reasoning limits in long contexts, scan cost, and safety-guardrail refusals — with Mythos unreleased and successors already named.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article…