Post-Mythos Vulnerability Discovery: Assessing Cost, Operational Realities, and Defensive Triage

The emergence of Anthropic's Mythos and OpenAI's defense-biased models has accelerated automated exploit generation, but high operational token costs and strict US regulatory interventions limit immediate deployment. Systems engineers must pivot toward open-source harnesses and leverage accessible LLMs to automate context-aware vulnerability prioritization.

Mythos and the Cost of Automated Exploit Generation

The announcement of Anthropic’s Claude Mythos Preview sparked industry-wide concern regarding fully automated zero-day hunting and exploitation. While early evaluations, such as the UK Government AI Security Institute’s cyber-range benchmark "The Last One," showed the model executing end-to-end attack chains from reconnaissance to network takeover, the reality under production conditions is more nuanced. The benchmark environments lacked active defenders, defensive tooling, and penalties for noisy actions that would normally trigger Security Operations Center (SOC) alerts.

Furthermore, automated vulnerability discovery at this scale remains highly resource-intensive. Replicating the discovery of the 27-year-old OpenBSD bug required running the model through a specialized scaffold 1,000 times, costing approximately $20,000 USD. Anthropic's Project Glasswing itself operated on a token budget of $100 million USD. Consequently, the immediate risk of high-tier automated exploit generation is restricted to well-funded actors rather than typical script kiddies.

Evaluating the Model Hierarchy and Harness Efficacy

While Mythos and its safeguard-heavy counterpart Fable 5 demonstrated distinct capabilities, several alternative models show varying degrees of utility. In benchmark comparisons, DeepSeek performs adequately in cloud environments, while self-hosted models like Gemma 4 and Qwen 3.6 manage to detect roughly half of the vulnerabilities identified by Mythos.

A key technical distinction lies in exploit generation versus simple detection. Although orchestration harnesses like those from Aisle can flag vulnerabilities using smaller models, these smaller LLMs fail to construct functional exploits. Mythos-class models retain a distinct advantage in proving exploitability, which dramatically reduces false-positive rates. During Project Glasswing trials, Mozilla reported an exceptionally low false-positive rate across 271 findings, and Cloudflare characterized the model's accuracy as superior to human testers.

Regulatory Restrictions and the Defensive Transition

Geopolitical intervention has significantly altered the availability of these models. The United States government blocked access to Fable and Mythos for all non-US citizens, even those residing on US soil, prompting Anthropic to temporarily suspend the offering. The access has since been tightly restricted, with Mythos opened to only a hundred US institutions.

Concurrently, OpenAI has advanced its security portfolio with GPT-5.5-Cyber, the Codex Security plugin, and its defense-focused models: Sol, Terra, and Luna. To avoid regulatory pushback, OpenAI’s "Daybreak" and "Patch the Planet" initiatives remain gatekept, prioritizing defensive capabilities over exploit generation. This artificial scarcity means that while elite firms have access to these advanced defensive models, the broader industry must rely on alternative architectures.

Tactical Engineering Guidance for Defending Systems

Systems engineers do not need to wait for restricted models to modernize their security posture. Highly capable alternatives exist within current operational reach. Teams can deploy open-source orchestration harnesses like Strix alongside local models such as Qwen or Gemma, or utilize API-driven inference with DeepSeek and GLM.

The primary engineering challenge remains vulnerability triage. Rather than attempting to patch every newly disclosed CVE, teams must implement context-aware prioritizations. Traditional vulnerability scoring systems fail to account for internal system architecture. Security teams should leverage accessible LLMs to parse local system state data, evaluating whether a vulnerability is business-critical, network-reachable, or mitigated by existing compensating controls.