For the past year, the question of whether frontier AI models posed a genuine, near-term threat to enterprise security has been treated as a matter of vendor marketing. Anthropic said Mythos was dangerous. Security teams discounted it because Anthropic is incentivised to say that. This week, that discount expired. Two independent organisations with no stake in the answer evaluated Mythos and arrived at the same conclusion: frontier AI models are now genuinely competent at serious cyber work. The question is no longer whether. It is how fast, how cheap, and what you do about it before open-weights equivalents are generally available in approximately six months.
This briefing is written for security architects, CISOs, and security operations leaders in organisations whose software or infrastructure touches payments, browsers, operating systems, cloud services, healthcare, finance, industrial control systems, or developer tooling. It is also relevant for channel professionals and vendors selling into the security stack who need to understand how the threat landscape has shifted and what that means for buyer conversations happening right now.
Vulnerability discovery has always been constrained by the cost and scarcity of expert human time. Finding a 27-year-old bug in OpenBSD requires years of accumulated expertise and significant focused effort. That constraint has historically limited the scale at which serious vulnerability research both offensive and defensive can be conducted. Frontier AI models are in the process of eliminating that constraint. The same capability that allows a defender to scan a codebase for previously unknown vulnerabilities allows an attacker to do the same, at a fraction of the cost and time. The cost asymmetry that has always favoured defenders is shifting.
| Metric | Mythos (Anthropic) | GPT-5.5 (OpenAI) |
|---|---|---|
| Expert cyber task score UK AISI full attack chain benchmark | 68.6% | 71.4% |
| Full attack chain completion (10 attempts) | 3 completions | 2 completions |
| Chain progression on same token budget | Farther than any model tested | Strong exceeds prior trend |
| Notable independent finding | 27-year-old OpenBSD CVE discovered | Reverse-engineering task: 10 min 22 sec / $1.73 |
| Capability strength profile | Deep codebase analysis and chain depth | Speed and cost efficiency on defined tasks |
| Current availability | Restricted approximately 50 organisations | Generally available now |
The two evaluating organisations were XBOW, a dedicated cybersecurity AI research organisation, and the UK AI Security Institute (AISI). Their evaluations were independent of Anthropic and represent the first time outside researchers have publicly confirmed the capability jump at this level.
The AISI ran a full simulated corporate network attack every stage stacked in order of difficulty against multiple models simultaneously on the same token budget. The attack chain tested covered reconnaissance, credential theft, lateral movement, web application exploitation, privilege escalation, command and control persistence, infrastructure compromise, and full network takeover. Models tested alongside Mythos included GPT-5.5, GPT-5.5 Cyber, Opus variants, Codex models, and older baselines.
Mythos winning here is not Mythos beating a weak baseline. It is outrunning an extremely strong model on a task where token spend is a metric that matters.
Nate B. Jones, AI News & Strategy Daily
XBOW found Mythos genuinely excels at source code audits, native code vulnerability discovery, and reverse engineering. They also identified important limitations: the model can be too literal in its interpretation of vulnerability context, may overstate the relevance of findings without proper triage, and requires validation infrastructure to be deployed responsibly.
The cost finding from the GPT-5.5 evaluation is equally significant: a reverse-engineering task that takes a human expert twelve hours was completed by GPT-5.5 in ten minutes and twenty-two seconds at a cost of $1.73. As the cost of finding subtle bugs falls, the number of actors capable of attempting serious exploitation increases exponentially.
| Evaluation criterion | What to look for | Red flags |
|---|---|---|
| Benchmark independence | Evaluations conducted by organisations with no vendor relationship | Only vendor-produced benchmarks available |
| Attack chain completeness | Full end-to-end chain tested, not isolated capability | Benchmark tests only isolated steps, not chain completion |
| Validation requirements | Tool requires human validation before findings are escalated | Tool presents findings as confirmed vulnerabilities without triage |
| Cost and speed transparency | Cost per task and time-to-completion published | No cost or speed benchmarks available |
| Dual-use disclosure | Vendor has published responsible use and access control policy | No discussion of offensive capability or access restrictions |
| Integration with existing workflow | Findings can be tracked separately from existing static analysis tooling | Output format incompatible with existing vulnerability management pipeline |
| Open-weights roadmap awareness | Vendor has a stated position on open-weights parity timeline | No acknowledgement of open-weights equivalents arriving |
No it means the nature of security research work is changing. AI is becoming highly capable at the discovery phase: finding bugs, identifying patterns in large codebases, and reverse-engineering binaries. The work that remains firmly in the human domain is contextual: understanding the business impact of a finding, assessing real-world exploitability, coordinating responsible disclosure, and making prioritisation decisions under uncertainty. Security teams that integrate AI into discovery workflows free up expert human time for the higher-judgment work that AI cannot yet reliably perform.
Both models performed at comparable levels on the AISI benchmark, with GPT-5.5 scoring slightly higher in aggregate (71.4% vs 68.6%). The character of their capability differs: Mythos demonstrated deeper chain progression and more sophisticated codebase analysis on complex tasks; GPT-5.5 demonstrated faster and cheaper task completion on well-defined reverse-engineering challenges. GPT-5.5 is generally available now. Mythos access is currently restricted to approximately 50 organisations. For teams starting today, GPT-5.5 and GPT-5.5 Cyber are the practical options.
These are the access and deployment programmes through which Anthropic and OpenAI are making their most capable security-relevant models available to defenders. Anthropic's Project Glass Wing restricts Mythos to approximately 50 trusted organisations and critical software partners, with a focus on finding and fixing vulnerabilities before less careful actors access equivalent capability. A proposed expansion to 120 organisations was blocked by the White House. OpenAI's Project Daybreak makes GPT-5.5 and GPT-5.5 Cyber available through trusted partners for defensive workflows including patch validation, threat modelling, and vulnerability triage. It is generally available and actively being rolled out.
The six-month estimate for open-weights models reaching Mythos-level capability is an approximation, not a guarantee but the directional trend is clear. Security teams should use the current restricted window to build and validate model-assisted vulnerability discovery workflows, establish baseline metrics for what AI surfaces versus existing static analysis tooling, and develop the human validation processes that will be needed when the capability is widely accessible. Teams that start from zero when open-weights equivalents arrive will be significantly disadvantaged relative to those who have six months of workflow maturity.
The appropriate risk posture depends on the sensitivity of the codebase and the data governance requirements of the organisation. XBOW's evaluation noted that Mythos and equivalent models require validation infrastructure to be deployed responsibly the model's findings should be treated as candidate vulnerabilities requiring human triage, not confirmed exploitable issues. Organisations in regulated sectors should review their data handling and third-party processing agreements before submitting production code to any external model API.
Anthropic was not exaggerating when it said Mythos would be risky to release without restriction. Independent researchers have now confirmed this. The capability is real. The cost curve is real. The dual-use risk is real.
Security teams have a rare and time-limited opportunity: the most capable models are still restricted. GPT-5.5 is available today at demonstrated capability. The right response is not to wait for Mythos access or for the open-weights moment to arrive. It is to begin building model-assisted security workflows now, measure what AI surfaces against what existing tools miss, and build the human validation capacity that will determine whether the capability is a defence advantage or a liability.
Mythos was not a myth. The window to prepare is now.
Signal.lab tracks AI capability developments and their implications for the IT and cyber security channel. Contributors with expertise in security architecture, threat intelligence, and AI-assisted security tooling are invited to publish structured insights on the network.
" }