Mythos Hype Cools: AI Zero-Day Hunting Is Real, Costly, and Gated

Anthropic’s Claude Mythos was pitched as a watershed for automated zero-day discovery and exploitation, and early access partners under the locked-down “Project Glasswing” program backed up the alarm — the UK’s AI Security Institute called it the first model to clear expert-level tasks and complete a full reconnaissance-to-takeover cyber range. The author’s read is more measured: the gains over predecessors like Opus 4.6 and GPT-5.4 are incremental, and the benchmarks omit the active defenders, alerting, and defensive tooling that any mature SOC runs, where these models would be noisy and clumsy. The much-publicized decades-old bugs in OpenBSD and FFmpeg are framed as clickbait — a vulnerability’s age reflects that nobody skilled looked there before, not how hard it was to find.

The genuine shift is economic. Finding the OpenBSD bug took roughly a thousand scaffolded runs at about $20,000, against a Glasswing token budget reported near $100 million — capabilities that raise the ceiling for well-funded actors who already had serious offensive resources, not for the average script kiddie. Cheaper replications tell a nuanced story: self-hostable models like Gemma 4 and Qwen 3.6 surfaced about half the vulnerabilities Mythos did, but couldn’t produce working exploits. That ability to actually prove exploitability — plus the very low false-positive rates claimed by Mozilla and Cloudflare — is what currently separates the Mythos tier from everything else, assuming those claims hold up under wider use.

The wildest variable is policy. Washington blocked Mythos and Fable for all non-US citizens, even those on US soil, forcing Anthropic to pull the offering entirely — an ironic harvest for a company that spent years lobbying for tighter AI controls. OpenAI is advancing on the defender-friendly side with GPT-5.5-Cyber, its Codex Security plugin, and the new Sol/Terra/Luna line, but under the same gated, government-vetted distribution. The author’s takeaway for practitioners: this artificial scarcity buys time, so use the lull to shore up fundamentals rather than panic.