Mythos, nine weeks on

By now your inbox has probably absorbed a dozen versions of the same Mythos email: the model that finds and writes its own exploits, the release Anthropic judged too dangerous to ship, and the closing line about the ground having shifted. We sat it out. A thirteenth version seemed less useful than waiting until we had something with a bit more behind it.

Where we land

Mythos is not much better at offensive cyber than the models it shares a leaderboard with. In the weeks after the disclosure, the team at AISLE rebuilt much of the headline analysis using small open-weight models you can download, and a separate group recovered Mythos-style findings with GPT-5.4 and Claude Opus 4.6. On the UK AI Security Institute’s Expert-tier cyber suite, GPT-5.5 now comes in slightly above it, roughly 71% to Mythos’s 69%.

This isn’t really about Anthropic, and you can’t procure your way out of it.

Concretely: when Daniel Stenberg, the curl maintainer, ran Mythos against his own codebase, it found one vulnerability. Singular.

The longer arc

Our R&D, led by Dr. Andrei Kucharavy, has been studying LLMs and cyber defense since 2020, so very little of what Mythos showed off came as a surprise. The capability has been there for a while. Neural networks were already finding unknown vulnerabilities by 2021, and by 2023 GPT-3 alone was pulling more than two hundred out of a single codebase, but only when someone who knew what they were doing pointed it in the right direction.

What has changed since is the entry price. We think of it as a ratio, severity over competence. Experts with a sharper tool were never the worry. The shift that matters is serious capability drifting down to people with almost no skill, because models have got so much better at writing code and at working out what a half-formed request is really asking for. The gate that skill used to provide is mostly gone.

Two pressures

Two pressures drive this, and they push from opposite directions. On the offense side, models that keep getting more capable. On the other, the increasingly vibe-coded internet: coding assistants that still ship insecure code, agentic tools that quietly write exploitable bugs as they autocomplete, and a public pool of knowledge that decays as it fills with machine-written answers. Across model generations from 2023 to 2025, Pr. Kucharavy’s lab finds the rate at which assistants reproduce well-known vulnerability classes has barely budged. Both ends of the attack surface are widening at once.

If you are the one defending something

The gap is one of speed rather than brilliance, and the same coding models making us nervous are already sitting on your side of the table. Our advice is deliberately dull.

You do not need a cutting-edge offensive model to find the known vulnerability patterns already in your own code, so find them before someone else does. Shorten the time between a flaw existing and a fix shipping. Aim for a detect-and-respond loop that closes inside thirty minutes or so, about as long as one of these reasoning chains runs before it stops, because that is the pace lateral movement happens at now. And keep checking, because a control that cleared an audit six months ago may have quietly stopped holding.

This is ordinary defensive discipline, run at the speed the threat now moves and held to the standard the field usually keeps for offense. That is the work we do at Surelio: testing GenAI systems independently, and being straight about what holds up and what does not.