Anthropic’s Claude Mythos is only the beginning of a new era of autonomous vulnerability discovery and exploit development, with the underlying capabilities that made Mythos a milestone already beginning to appear elsewhere.

New models from U.S. and international developers are beginning to narrow the gap between what is currently guarded by Project Glasswing and what cyber attackers could potentially use to turn this capability against defenders. Anthropic itself has said it expects many other companies to develop Mythos-class models within six to 12 months.

Chinese developer Z.ai recently released GLM-5.2 under an open-weight MIT license, which Semgrep researchers found beat Claude Opus, OpenAI’s GPT-5.5 and other open-weight models in Insecure Direct Object Reference (IDOR) detection tasks. Another Chinese company, 360 Security Technology, recently announced a multi-agent system called Tulongfeng, which Founder Zhou Hongyi called “China’s version of Mythos,” according to Forbes.

In Japan, Sakana AI announced a multi-model orchestration system called Fugu Ultra, which it claims “stands shoulder-to-shoulder with leading models like Fable 5 and Mythos Preview” in engineering, science and reasoning benchmarks. And last week, OpenAI released its “strongest cybersecurity model yet,” GPT-5.6, which surpassed Mythos Preview in ExploitBench results and has its greatest defense capabilities restricted behind the OpenAI Daybreak Trusted Access for Cyber program.

Semgrep’s blog post sharing results from its testing of GLM-5.2 is titled “We have Mythos at home,” but Semgrep Co-founder and CTO Drew Dennison emphasized in an email interview with SC Media that open-weight models have not yet caught up to Mythos’ most consequential capabilities.

“GLM-5.2 with zero scaffolding beat Claude Code on our IDOR detection benchmark, the first time we’ve seen a knockoff-priced model outpunch a frontier coding agent,” Dennison said. “But detection was never the party trick. Mythos’s real flex was exploit generation, turning a hunch into a working, verified exploit at scale. Nothing open-weight is close to that.”

The distinction between detecting a potential vulnerability and reliably producing a working exploit is what made Mythos so disruptive to begin with, and why the U.S. government recently sought to restrict access to its latest versions with a now-lifted export control directive. Anthropic has said Mythos can identify and exploit zero-day vulnerabilities across major operating systems and browsers, while the UK AI Security Initiative reported that Mythos became the first model to complete both of its cyber ranges end to end.

But defenders may not need to wait for an open model to fully match Mythos before the economics of vulnerability discovery begin to change. Cheaper models can be run repeatedly and paired with stronger scaffolding or combined with other systems, potentially giving a wider range of defenders and attackers access to capabilities that were previously concentrated among a few frontier AI labs.

“The biggest swings in our own testing weren’t model versus model, they were bare prompt versus a model wrapped in a decent harness, something that scopes the code and points the model at real attack surfaces instead of just saying ‘find the bugs,’” Dennison noted.

How open-weight models are beginning to close the gap

Semgrep’s benchmark focused on IDORs, a common class of access-control vulnerability in which an application fails to properly verify whether a user is authorized to access a requested object.

The company tested GLM-5.2 alongside Claude Code running Opus 4.6, 4.7 and 4.8 and found that GLM-5.2 with a bare prompt outperformed Claude Code at a cost of approximately $0.17 per vulnerability found — about an eighth of the cost of frontier LLMs, Semgrep said. More specifically, GLM-5.2 had an F1 — a score that balances precision and recall — of 39% compared with 37% scored by the highest-performing Claude model, Opus 4.6.

However, the highest scores in Semgrep’s tests came from models running in a custom multimodal harness the company developed itself, which enumerates endpoints and directs models to them. With this harness, GPT-5.5 scored an F1 of 61%, and Opus 4.8 an F1 of 53%.

“A public Claude model or an open-weight one like GLM 5.2 will both earn their keep today if you build that scaffolding around them,” Dennison said. “Run more than one model while you’re at it. Vulnerability hunting rewards diversity over a simple genius in the corner. And don’t ignore cost: a cheap model run 10 times can beat an expensive one run once.”

Semgrep cautioned in its blog post that the result represented one run, one dataset and one vulnerability class, and should not be treated as proof that open-weight models have fully caught up to frontier cyber models more broadly.

Still, the results show why comparisons based only on a model’s origin, price and access restrictions may quickly become outdated. GLM-5.2 is publicly downloadable and deployable under an MIT license, meaning organizations can run or modify it without depending on a controlled-access program.

Dennison, whose company also has access to Mythos under Project Glasswing and OpenAI’s latest models under the Trusted Access for Cyber program, said one of the biggest misconceptions about these models is that restricting access means the broader risk is contained.

“Open-weight models are closing the gap fast, and gating the frontier doesn’t touch what’s already sitting on a GPU somewhere,” he said.

At the same time, Dennison said leaderboard results should not be viewed as a complete measure of cyber capability. A model that performs well on vulnerability detection may still struggle to validate a finding, create a reliable proof of concept or move through the stages of a real attack.

That limitation separates GLM-5.2’s benchmark result from the more advanced capabilities attributed to Mythos.

“GLM found the needle. Mythos built a machine that also threats it, ten thousand times an hour, for cheap,” Dennison said.

Model restrictions face a diffusion problem

The spread of cyber capability across foreign and open-weight models complicates government efforts to restrict access to the most powerful systems.

Anthropic has limited Mythos access through Project Glasswing and publicly released its “Mythos-tier” Fable model with strict guardrails on its cyber capabilities. The U.S. government temporarily imposed export restrictions on Mythos and Fable before lifting them after additional safeguards were implemented. OpenAI has taken a tiered-access approach with its own cyber-focused models, through its OpenAI Daybreak program.

Restrictions targeting one company or specific models may have a diminishing impact as similar capabilities emerge through foreign labs, open-weight releases, distillation and multi-model orchestrations. For example, Sakana AI specifically highlights in its announcement of Fugu Ultra that the system “delivers frontier capability without the risk of export controls” by orchestrating multiple agents and dynamically rerouting to other models when one is restricted.

Srinivas Mukkamala, CEO of Securin, said software and AI capabilities move faster than regulatory systems that were originally designed to govern access to physical technologies, such as advanced chips, can realistically keep pace.

“The real problem isn’t whether one model crossed some line — it’s that capability diffuses faster than any control regime can track,” Mukkamala told SC Media. “What’s frontier this month is open-weight in a few weeks.”  

Mukkamala said governments should place greater emphasis on the systems these models could be used to target, rather than focusing exclusively on who can obtain a particular model.

“That means testing critical systems — power grids, hospitals, government networks — the way an attacker actually would, and fixing the real weak points before they’re exploited,” he said.

Such efforts are likely underway in the U.S., as Reuters reported that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) began using Mythos to scan government systems for vulnerabilities shortly after export controls on the model were lifted.  

Mukkamala likens AI model access to the way the Food and Drug Administration (FDA) regulates access to vaccines, where safety comes first but equitable access should also be prioritized.

“We didn’t let vaccines stay a luxury item for the few who could afford them — we made access a public good. AI needs the same principle, or we’re going to create a new divide between the haves and have-nots, except this time the gap is intelligence itself,” Mukkamala said.

The model ‘race’ distracts from the operational problem

For enterprises, tracking which model leads a particular benchmark is less important than building a security program capable of adapting to continued advances across many models.

Ronen Shetelboim, chief marketing officer at Cycode, told SC Media organizations risk treating rapid model releases as a “spectator sport” rather than an operational challenge.

“Every month brings a new model claiming a new benchmark win, and it’s tempting to wait and see who ‘wins,’” Shetelboim said.

Organizations should monitor new releases and understand what emerging models can do, he said, but awareness alone does not amount to a strategy.

“What actually matters is whether you have the tools and framework to move at the speed of AI from a defensive perspective: agentic scanning, agentic remediation, and governance over what AI is doing in your pipeline,” Shetelboim said. “The model race is noise. Your ability to keep pace with it is what matters.”

Shetelboim recommended that organizations evaluate models according to output quality, efficiency and cost, rather than defaulting to the newest or more expensive option.

“Don’t use a complex and expensive frontier model on a simple task, and don’t try to save money by running a cheap model on a complex one,” he said.

He warned against falling into the trap of choosing one model and building an entire security strategy around it. A better strategy, he said, is “picking a multi-model approach, and picking vendors you trust to orchestrate that well, routing the right task to the right model so you solve the problem without burning your budget.”

“The tools and governance layer should be model-agnostic by design, so that when a better model ships next month, you can use it without rebuilding your stack around it,” Shetelboim concluded.  

From AI-assisted security to AI-first operations

Adopting more capable models does not automatically make a security team capable of operating at machine speed. Shetelboim said most organizations remain structured around human review cycles, ticket queues and manual handoffs that cannot match the pace of AI-generated code, automated vulnerability discovery and AI-assisted exploitation.

“Strategically, this starts with evolving the security org itself,” he said. “You need an AI-first mindset, not an AI-assisted one, an organization built to actually move at the speed of AI, not just talk about it.”

AI systems that rapidly reduce the time between vulnerability discovery and exploitation demand an AI-speed response, not a manual ticket queue.

“That means moving from a human-driven scan-triage-ticket model to an agent-driven and human-controlled model with continuous detection, remediation, and prevention, from prompt to runtime,” Shetelboim said.

AI-first also means proper visibility and governance over all areas where AI is used at an organization: knowing where AI agents are committing code, what systems and repositories those agents can access, where AI-generated changes enter the software lifecycle and what data is being sent to external models.

Mukkamala also emphasized the importance of tackling AI governance, even as standardized frameworks struggle to keep up with the latest advances and risks.

“Focus on the basics that never go out of style: know exactly what AI systems you’re running and what data they touch, test them like an attacker would instead of just trusting the vendor, and keep a human in the loop for the decisions that matter most,” Mukkamala said.

Faster discovery increases the need for containment

Even organizations that improve vulnerability detection and remediation may be unable to patch every flaw before it is exploited. Raghu Nandakumara, vice president of industry strategy at Illumio, said the availability of advanced AI capabilities exposes the limitations of security strategies that rely primarily on preventing intrusions and detecting attackers before they gain access.

“For twenty years, security strategy has rested on two legs: prevention, and detection & response,” Nandakumara told SC Media. “Both are still necessary. Neither is sufficient anymore.”

Prevention assumes defenders can identify and patch vulnerabilities before attackers exploit them, and detection and response assume defenders have enough time to identify an intrusion before it causes widespread damage.

“When AI can find and weaponize that flaw before a CVE is even published, that assumption no longer holds,” Nandakumara said. “Detection and response assumes you can catch an attacker before real damage spreads, but when attacks execute at machine speed, that window collapses too.”

Nandakumara argued that organizations need a third pillar: containment.

This includes limiting which systems can communicate, removing unnecessary access, applying least privilege and segmenting sensitive environments so that the compromise of one system does not automatically enable lateral movement throughout a network.

Government bodies and regulatory institutions have previously emphasized containment as a response strategy for AI-enabled cyber risk, even before Mythos took center stage. For example, a 2024 industry letter from the New York Department of Financial Services emphasizes the use of access controls, zero-trust principles and a defense-in-depth approach in mitigating AI-powered cyberattacks.

More recently, CERT-EU recommendations for defenders in response to the release of Mythos Preview included reducing attack surfaces, accelerating zero-trust adoption, reviewing privileged access and using network segmentation to limit an attacker’s ability to move across systems.

“The organisations that get through the next few years won’t be the ones with the fastest patch cycle. They’ll be the ones who accepted that breach is a certainty and built their strategy to contain it,” Nandakumara said.

For CISOs with limited budgets, Nandakumara said additional detection tools may provide less value than understanding and restricting what is reachable inside the environment.

“You know you have vulnerabilities. Frontier AI powered tools don’t change that fact, they just mean every one of them gets found and exploited faster than your team can patch,” he said.

Rather than “buying more visibility” with a new EDR feature or AI-powered scanner, Nandakumara recommended organizations invest time and budget into mapping which systems can communicate with one another, removing access that is no longer needed and reducing lateral movement paths before an attacker gains a foothold.

“The scanner tells you the house is on fire. Segmentation is what stops it from burning down,” he concluded.